BinPAC

What's BinPAC?

BinPAC is a high level language for describing protocol parsers. The BinPAC compiler generates C++ code. We have written a few Bro protocol analyzers using BinPAC, including CIFS/SMB, DCE/RPC, HTTP, DNS, NCP, and Sun/RPC. The BinPAC-based parsers have almost same performance as the hand-written ones. On the other hand, writing parsers in BinPAC is easier and the code is more maintainable.

BinPAC is open-source with the same licence Bro has. The newest version is released with Bro 1.2.

Finally, while the BinPAC compiler is released with Bro, it is designed to be general-purpose and so can be used to generate parsers for other programs as well.

More information on BinPAC can be found in our IMC '06 paper:

BinPAC: a yacc for Writing Application Protocol Parsers,
Ruoming Pang, Vern Paxson, Robin Sommer, and Larry Peterson (PDF,ACM).

A Brief Guide to BinPAC

In this guide we show how to build a BinPAC-based SMTP parser from scratch. We start with a most primitive version and refine it step-by-step. Are you ready? Let's start!

Userguide (In Progress)

An attempt to capture binpac's language/methodology as well as development direction. Take a look