[Bro] Fwd: binpac: variable length

da5id psp pspda5id at gmail.com
Thu Sep 9 13:41:28 PDT 2010

Hi, I'm using binpac as a standalone parser for RTMP (

RTMP is a binary protocol that does not delimit frames/chunks like other
fixed frame protocols. eg. An RTMP chunk can be of type 0-3, the only way to
find the length is to first read the whole packet and then derive the length
depending on the chunk type.

My question is how can I do this in binpac since the enclosing record
expects a length but it can only be provided after parsing the child
records, eg.

type Chunk0 = record {

type Chunk0 = record {
} &let {
   msgLen = # calculated from chunkId

type Chunk = record {
   chunk: case basicHeader of {
       0 -> chunk0:Chunk0;
       1 -> chunk0:Chunk1;
       2 -> chunk0:Chunk2;
       3 -> chunk0:Chunk3;
   data: bytestring &restofdata;
} &length = ???;

Any help will be appreciated. Thanks.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20100909/eaf00217/attachment.html 

More information about the Bro mailing list