# Additional service ports

**URL:** https://community.zeek.org/t/additional-service-ports/2902
**Category:** Zeek
**Created:** [November 13, 2013, 3:30pm UTC](https://community.zeek.org/t/additional-service-ports/2902 "2013-11-13T15:30:41Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)
#### Post date: [November 13, 2013, 3:30pm UTC](https://community.zeek.org/t/additional-service-ports/2902/1 "2013-11-13T15:30:41Z")

</div>

Hey all,

Quick question...say I have http traffic on the usual 80, and 8001? How does one tell Bro that there's an additional port to analyze? Thank you.

James

---

<div class="post-metadata">

### Author: ![anthony\_kasza1](https://avatars.discourse-cdn.com/v4/letter/a/dfb087/32.png) [@anthony\_kasza1](https://community.zeek.org/u/anthony_kasza1)
#### Post date: [November 13, 2013, 3:59pm UTC](https://community.zeek.org/t/additional-service-ports/2902/2 "2013-11-13T15:59:22Z")

</div>

The ‘Determining Analyzer Activation’ section in the following link might be helpful.  
[http://www.bro.org/development/howtos/dpd.html](http://www.bro.org/development/howtos/dpd.html)

Hey all,

Quick question…say I have http traffic on the usual 80, and 8001?  
How does one tell Bro that there’s an additional port to analyze? Thank  
you.

James

---

<div class="post-metadata">

### Author: ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)
#### Post date: [November 13, 2013, 5:39pm UTC](https://community.zeek.org/t/additional-service-ports/2902/3 "2013-11-13T17:39:14Z")

</div>

Oops! That section should have been deprecated with 2.2, it doesn't work that way anymore. You can do the following, but I'm not sure if it overwrites the default list of ports used or not...

event bro\_init()  
&nbsp;&nbsp;{  
&nbsp;&nbsp;Analyzer::register\_for\_ports(Analyzer::ANALYZER\_HTTP, set(12345/tcp));  
&nbsp;&nbsp;}

&nbsp;&nbsp;.Seth

---

<div class="post-metadata">

### Author: ![Siwek\_Jon](https://avatars.discourse-cdn.com/v4/letter/s/90db22/32.png) [@Siwek\_Jon](https://community.zeek.org/u/Siwek_Jon)
#### Post date: [November 13, 2013, 6:10pm UTC](https://community.zeek.org/t/additional-service-ports/2902/4 "2013-11-13T18:10:40Z")

</div>

It’s additive; doesn’t overwrite.

- Jon

---

<div class="post-metadata">

### Author: ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)
#### Post date: [November 13, 2013, 6:20pm UTC](https://community.zeek.org/t/additional-service-ports/2902/5 "2013-11-13T18:20:01Z")

</div>

Thanks Seth...I'll give that a go.

James

---

<div class="post-metadata">

### Author: ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)
#### Post date: [May 6, 2022, 3:41pm UTC](https://community.zeek.org/t/additional-service-ports/2902/6 "2022-05-06T15:41:23Z")

</div>