<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<body>
<div dir="auto">
<div dir="auto">I took a look at the dp3 files, but I couldn't find anything that helps with my use case - - maybe I'm just blind and I missed it. However, I did find this older question that fits pretty close to mine:</div><div dir="auto"><a href="https://marc.info/?l=bro&m=146194027831545&w=2">https://marc.info/?l=bro&m=146194027831545&w=2</a></div><div dir="auto"><br></div><div dir="auto">I still feel like there's probably a better way to solve this issue than what's presented. I'll try it out though, unless anyone knows of any better methods. </div><div dir="auto"><br></div><div dir='auto'><br></div>
<div id="aqm-original" style="color: black;">
<!-- body start -->
<div class="aqm-original-body">
<div style="color: black;">
<p style="color: black; font-size: 10pt; font-family: sans-serif; margin: 8pt 0;">On June 27, 2019 2:09:31 PM Hugo <hugolin615@gmail.com> wrote:</p>
<blockquote type="cite" class="gmail_quote" style="margin: 0 0 0 0.75ex; border-left: 1px solid #808080; padding-left: 0.75ex;">
<div dir="ltr"><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">Hi Enki,</div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif"><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">I have not read C37.118 in details before. But I contributed the DNP3 analyzer in Bro both on top of TCP and UPD, may be you can take a look. DNP3 also have some similar characteristics, like the parsing of the current packets depends on the previous packet. Hope this helps.</div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif"><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">Best,</div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif"><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">Hui Lin</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Jun 27, 2019 at 10:09 AM Enki <<a href="mailto:fyiohhai@gmail.com">fyiohhai@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">
<p class="MsoNormal" style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif">I’m trying to create my first protocol analyzer with BinPac
for the synchrophasor protocol (IEEE Std C37.118) – from what I can tell,
nobody has made an analyzer for it yet. I'm trying to define the message format
in synchrophasor-protocol.pac. However, stuff like the format of data packets are based on a previously sent configuration packet. How do I write
synchrophasor-protocol.pac so I can parse them based on the previously sent packet? Here’s some documentation on the protocol
if you need it: <a href="http://smartgridcenter.tamu.edu/resume/pdf/1/SynPhasor_std.pdf" style="color:rgb(5,99,193);text-decoration:underline" target="_blank">http://smartgridcenter.tamu.edu/resume/pdf/1/SynPhasor_std.pdf</a><span></span></p>
<p class="MsoNormal" style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"><span> </span></p>
<p class="MsoNormal" style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif">Again, this is my first time trying to write a protocol
analyzer with BinPac, so sorry if this is obvious.<span></span></p>
<p class="MsoNormal" style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"><span> </span></p>
<p class="MsoNormal" style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif">Thank you<span></span></p>
</div>
_______________________________________________<br>
Zeek mailing list<br>
<a href="mailto:zeek@zeek.org" target="_blank">zeek@zeek.org</a><br>
<a href="http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek" rel="noreferrer" target="_blank">http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek</a></blockquote></div>
</blockquote>
</div>
</div>
<!-- body end -->
</div><div dir="auto"><br></div>
</div>
<div style="color: black;">
<p style="margin: 0 0 1em 0; color: black; font-family: sans-serif;">Sent with <a href="https://play.google.com/store/apps/details?id=org.kman.AquaMail">AquaMail for Android</a><br>
<a href="https://www.mobisystems.com/aqua-mail">https://www.mobisystems.com/aqua-mail</a></p>
</div>
</body>
</html>