Spicy - Generating Robust Parsers For Protocols & File Formats

The talk starts from the problem with writing protocol analyzers for Zeek, the open-source network monitor. Hand-written C++ parsers are dense, easy to get subtly wrong, and exposed to malformed traffic, so the speaker argues for a higher-level description of message layouts. A quick tour of Zeek's connection, HTTP and file logs shows the kind of summarized output such parsers feed.

The core of the talk introduces Spicy, a domain-specific language for describing binary and text formats. Units declare typed fields that can be reused, and hooks attach procedural code at stages of parsing. The TFTP example branches on opcodes, uses look-ahead to pick sub-parsers, and resynchronizes after gaps. A small CSV grammar shows reshaping parsed output, and the toolchain compiles grammars into C++ shared libraries that a driver loads. A Wireshark plugin that reflects on the generated parsers illustrates the idea.

The closing section covers Zeek integration through a glue layer that maps Spicy hooks to Zeek events and binds analyzers to ports. The speaker notes that the Zeek-side logic for TFTP was more involved than the grammar itself. Audience questions focused on memory safety, where the answer was that generated C++ relies on checked containers and safe integer types rather than a language guarantee. The takeaway is to consider Spicy before writing a new Zeek analyzer and to contribute grammars for less common protocols and file formats.