diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index 5d21c36e71..bc68d0d67f 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -162,7 +162,6 @@ binpac_target(modbus.pac
 set(bro_PLUGIN_OBJECT_LIBS CACHE INTERNAL "plugin object libraries" FORCE)
 
 add_subdirectory(analyzer)
-add_subdirectory(protocols)
 
 set(bro_SUBDIRS
     $<TARGET_OBJECTS:bro_analyzer>
@@ -392,7 +391,7 @@ set(bro_SRCS
     plugin/Manager.cc
     plugin/Plugin.cc
 
-    protocols/BuiltInAnalyzers.cc
+    analyzer/protocols/BuiltInAnalyzers.cc
 
     nb_dns.c
     digest.h
diff --git a/src/analyzer/CMakeLists.txt b/src/analyzer/CMakeLists.txt
index 68742116ef..1172b0d811 100644
--- a/src/analyzer/CMakeLists.txt
+++ b/src/analyzer/CMakeLists.txt
@@ -4,6 +4,8 @@ include_directories(BEFORE
                     ${CMAKE_CURRENT_BINARY_DIR}
 )
 
+add_subdirectory(protocols)
+
 set(analyzer_SRCS
     Analyzer.cc
     Manager.cc
diff --git a/src/protocols/BuiltInAnalyzers.cc b/src/analyzer/protocols/BuiltInAnalyzers.cc
similarity index 99%
rename from src/protocols/BuiltInAnalyzers.cc
rename to src/analyzer/protocols/BuiltInAnalyzers.cc
index b3597c63df..8403b1bb25 100644
--- a/src/protocols/BuiltInAnalyzers.cc
+++ b/src/analyzer/protocols/BuiltInAnalyzers.cc
@@ -5,7 +5,7 @@
 #include "BuiltInAnalyzers.h"
 #include "analyzer/Component.h"
 
-#include "../binpac_bro.h"
+#include "../../binpac_bro.h"
 
 #include "AYIYA.h"
 #include "BackDoor.h"
diff --git a/src/protocols/BuiltInAnalyzers.h b/src/analyzer/protocols/BuiltInAnalyzers.h
similarity index 100%
rename from src/protocols/BuiltInAnalyzers.h
rename to src/analyzer/protocols/BuiltInAnalyzers.h
diff --git a/src/protocols/CMakeLists.txt b/src/analyzer/protocols/CMakeLists.txt
similarity index 100%
rename from src/protocols/CMakeLists.txt
rename to src/analyzer/protocols/CMakeLists.txt
diff --git a/src/protocols/http/CMakeLists.txt b/src/analyzer/protocols/http/CMakeLists.txt
similarity index 100%
rename from src/protocols/http/CMakeLists.txt
rename to src/analyzer/protocols/http/CMakeLists.txt
diff --git a/src/protocols/http/HTTP.cc b/src/analyzer/protocols/http/HTTP.cc
similarity index 100%
rename from src/protocols/http/HTTP.cc
rename to src/analyzer/protocols/http/HTTP.cc
diff --git a/src/protocols/http/HTTP.h b/src/analyzer/protocols/http/HTTP.h
similarity index 100%
rename from src/protocols/http/HTTP.h
rename to src/analyzer/protocols/http/HTTP.h
diff --git a/src/protocols/http/events.bif b/src/analyzer/protocols/http/events.bif
similarity index 100%
rename from src/protocols/http/events.bif
rename to src/analyzer/protocols/http/events.bif
diff --git a/src/protocols/http/functions.bif b/src/analyzer/protocols/http/functions.bif
similarity index 100%
rename from src/protocols/http/functions.bif
rename to src/analyzer/protocols/http/functions.bif
diff --git a/src/protocols/ssl/CMakeLists.txt b/src/analyzer/protocols/ssl/CMakeLists.txt
similarity index 100%
rename from src/protocols/ssl/CMakeLists.txt
rename to src/analyzer/protocols/ssl/CMakeLists.txt
diff --git a/src/protocols/ssl/Plugin.cc b/src/analyzer/protocols/ssl/Plugin.cc
similarity index 100%
rename from src/protocols/ssl/Plugin.cc
rename to src/analyzer/protocols/ssl/Plugin.cc
diff --git a/src/protocols/ssl/SSL.cc b/src/analyzer/protocols/ssl/SSL.cc
similarity index 100%
rename from src/protocols/ssl/SSL.cc
rename to src/analyzer/protocols/ssl/SSL.cc
diff --git a/src/protocols/ssl/SSL.h b/src/analyzer/protocols/ssl/SSL.h
similarity index 100%
rename from src/protocols/ssl/SSL.h
rename to src/analyzer/protocols/ssl/SSL.h
diff --git a/src/protocols/ssl/events.bif b/src/analyzer/protocols/ssl/events.bif
similarity index 100%
rename from src/protocols/ssl/events.bif
rename to src/analyzer/protocols/ssl/events.bif
diff --git a/src/protocols/ssl/ssl-analyzer.pac b/src/analyzer/protocols/ssl/ssl-analyzer.pac
similarity index 100%
rename from src/protocols/ssl/ssl-analyzer.pac
rename to src/analyzer/protocols/ssl/ssl-analyzer.pac
diff --git a/src/protocols/ssl/ssl-defs.pac b/src/analyzer/protocols/ssl/ssl-defs.pac
similarity index 100%
rename from src/protocols/ssl/ssl-defs.pac
rename to src/analyzer/protocols/ssl/ssl-defs.pac
diff --git a/src/protocols/ssl/ssl-protocol.pac b/src/analyzer/protocols/ssl/ssl-protocol.pac
similarity index 100%
rename from src/protocols/ssl/ssl-protocol.pac
rename to src/analyzer/protocols/ssl/ssl-protocol.pac
diff --git a/src/protocols/ssl/ssl.pac b/src/analyzer/protocols/ssl/ssl.pac
similarity index 100%
rename from src/protocols/ssl/ssl.pac
rename to src/analyzer/protocols/ssl/ssl.pac
diff --git a/src/protocols/syslog/CMakeLists.txt b/src/analyzer/protocols/syslog/CMakeLists.txt
similarity index 100%
rename from src/protocols/syslog/CMakeLists.txt
rename to src/analyzer/protocols/syslog/CMakeLists.txt
diff --git a/src/protocols/syslog/Plugin.cc b/src/analyzer/protocols/syslog/Plugin.cc
similarity index 100%
rename from src/protocols/syslog/Plugin.cc
rename to src/analyzer/protocols/syslog/Plugin.cc
diff --git a/src/protocols/syslog/Syslog.cc b/src/analyzer/protocols/syslog/Syslog.cc
similarity index 100%
rename from src/protocols/syslog/Syslog.cc
rename to src/analyzer/protocols/syslog/Syslog.cc
diff --git a/src/protocols/syslog/Syslog.h b/src/analyzer/protocols/syslog/Syslog.h
similarity index 100%
rename from src/protocols/syslog/Syslog.h
rename to src/analyzer/protocols/syslog/Syslog.h
diff --git a/src/protocols/syslog/events.bif b/src/analyzer/protocols/syslog/events.bif
similarity index 100%
rename from src/protocols/syslog/events.bif
rename to src/analyzer/protocols/syslog/events.bif
diff --git a/src/protocols/syslog/syslog-analyzer.pac b/src/analyzer/protocols/syslog/syslog-analyzer.pac
similarity index 100%
rename from src/protocols/syslog/syslog-analyzer.pac
rename to src/analyzer/protocols/syslog/syslog-analyzer.pac
diff --git a/src/protocols/syslog/syslog-protocol.pac b/src/analyzer/protocols/syslog/syslog-protocol.pac
similarity index 100%
rename from src/protocols/syslog/syslog-protocol.pac
rename to src/analyzer/protocols/syslog/syslog-protocol.pac
diff --git a/src/protocols/syslog/syslog.pac b/src/analyzer/protocols/syslog/syslog.pac
similarity index 100%
rename from src/protocols/syslog/syslog.pac
rename to src/analyzer/protocols/syslog/syslog.pac