# Zeek::PIA analyzer details

**URL:** <https://community.zeek.org/t/zeek-pia-analyzer-details/6277>\
**Category:** Zeek\
**Created:** [December 10, 2020, 1:22am UTC](https://community.zeek.org/t/zeek-pia-analyzer-details/6277 "2020-12-10T01:22:25Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ankith\_Kumar\_Hanuman](https://avatars.discourse-cdn.com/v4/letter/a/f04885/32.png) [@Ankith\_Kumar\_Hanuman](https://community.zeek.org/u/Ankith_Kumar_Hanuman)\
**Post date:** [December 10, 2020, 1:22am UTC](https://community.zeek.org/t/zeek-pia-analyzer-details/6277/1 "2020-12-10T01:22:25Z")

</div>

Hello.

Does anyone have any additional documentation for the Zeek::PIA plugin?

What does “PIA” stand for?

There are two plugin instantiations within the plugin code, i.e.  
Analyzer::ANALYZER\_TCP  
Analyzer::ANALYZER\_UDP

The plugin’s ‘description’ field says: “Analyzers implementing Dynamic Protocol”

Are these for packet level analysis (i.e. OSI Layer 2 protocols)

Thanks,

---

<div class="post-metadata">

**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\
**Post date:** [December 10, 2020, 8:44am UTC](https://community.zeek.org/t/zeek-pia-analyzer-details/6277/2 "2020-12-10T08:44:54Z")

</div>

Hi Brett,

it stands for “protocol independent analysis” and refers to Zeek’s ability to analyze application-layer protocols on top of TCP/UDP independent of their ports. The PIA is the component that figures out which protocol analyzer to use for a given session.

This is not related to packet level analysis. For that, the upcoming Zeek 4.0 introduces a new notion of “packet analyzers”, see [https://docs.zeek.org/en/master/frameworks/packet-analysis.html](https://docs.zeek.org/en/master/frameworks/packet-analysis.html)

Robin

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:47pm UTC](https://community.zeek.org/t/zeek-pia-analyzer-details/6277/3 "2022-05-06T15:47:31Z")

</div>