binpac: a yacc for writing application protocol parsers

A key step in the semantic analysis of network traffic is to parse the traffic stream according to the high-level protocols it contains. This process transforms raw bytes into structured, typed, and semantically meaningful data fields that provide a high-level representation of the traffic. However, constructing protocol parsers by hand is a tedious and error-prone affair due to the complexity and sheer number of application protocols. This paper presents binpac, a declarative language and compiler designed to simplify the task of constructing robust and efficient semantic analyzers for complex network protocols. We discuss the design of the binpac language and a range of issues in generating efficient parsers from high-level specifications. We have used binpac to build several protocol parsers for the “Bro” network intrusion detection system, replacing some of its existing analyzers (handcrafted in C++), and supplementing its operation with analyzers for new protocols. We ...

• Type: Conference
• Year: 2006
• Where: IMC
• Authors: Ruoming Pang, Vern Paxson, Robin Sommer, Larry L. Peterson
• Keywords: IMC 2006, Network Protocols, Network Traffic, Protocol Parsers