Robin Sommer

Conceptually, I'd say `Undef` would be the right thing to use here; it's meant to mean "something that we don't know anything more specific about". To distinguish it from "unset",...

Yeah, mulling over this a bit more, I prefer (3), too. Seems like some nice little magic to have, even if it's a bit odd to hardcode that one type....

> specifically it seems to ignore the functions that are set in Files::register_protocol This is now implemented by #3703. > it is somewhat common for binpac parsers to generate their...

> ah, so it's the individual analyzers that are doing that? Yes, correct, that's just been a convention originally, nothing hardcoded. > ``` > protocol analyzer LDAP over TCP: >...

I'm wondering if this is similar to what's happening with protocol analyzers already: there we don't immediately remove analyzers when requested to do so, but put them into a to-remove-later...

@bbannier @timwoj Not quite sure who's the best to review so tagging both of you.

This would be nice to do, but isn't trivial as some differences are expected, so one needs to dig in track things down. FWIW, the current HTTP and DNS analyzers...

Actually it was a deliberate decision to not use regular expressions: The underlying DFAs can get prohibitively large when many regexps are combined through '|'. For individual patterns, I'm not...

Mind providing more context?

Yeah, thanks, would be nice to have. Contributions welcome on this.