Additional service ports

Zeek
1

Hey all,

Quick question...say I have http traffic on the usual 80, and 8001? How does one tell Bro that there's an additional port to analyze? Thank you.

James

2

The ‘Determining Analyzer Activation’ section in the following link might be helpful.
http://www.bro.org/development/howtos/dpd.html

Hey all,

Quick question…say I have http traffic on the usual 80, and 8001?
How does one tell Bro that there’s an additional port to analyze? Thank
you.

James

3

Oops! That section should have been deprecated with 2.2, it doesn't work that way anymore. You can do the following, but I'm not sure if it overwrites the default list of ports used or not...

event bro_init()
  {
  Analyzer::register_for_ports(Analyzer::ANALYZER_HTTP, set(12345/tcp));
  }

  .Seth

4

It’s additive; doesn’t overwrite.

- Jon

5

Thanks Seth...I'll give that a go.

James