Within Zeek, there are two separate parser generators: Binpac (the old one) and Spicy (the new one). Both allow users to write protocol parsers by declaring what the protocol looks like rather than writing C++ code…
read more about Are Spicy parsers slower than Binpac parsers?We are happy to announce the release of Spicy 1.0, an open source parser generator that makes it much easier for Zeek—and other applications—to support new protocols and file formats. We had made an initial, experimental…
read more about Spicy 1.0 — Robust Parsers for Protocols & File FormatsIntroduction and Background I last wrote about detecting OpenVPN with Zeek, and to understand this blog you should familiarize yourself with that post. This blog will not repeat the basics of OpenVPN, but instead it will…
read more about A Zeek OpenVPN Protocol Analyzer in Spicy