# Bro Digest, Vol 28, Issue 2

**URL:** <https://community.zeek.org/t/bro-digest-vol-28-issue-2/1367>\
**Category:** Zeek\
**Created:** [August 5, 2008, 1:02am UTC](https://community.zeek.org/t/bro-digest-vol-28-issue-2/1367 "2008-08-05T01:02:00Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![CS\_Lee](https://avatars.discourse-cdn.com/v4/letter/c/35a633/32.png) [@CS\_Lee](https://community.zeek.org/u/CS_Lee)\
**Post date:** [August 5, 2008, 1:02am UTC](https://community.zeek.org/t/bro-digest-vol-28-issue-2/1367/1 "2008-08-05T01:02:00Z")

</div>

hi miguel,

If u are using hostname.bro which may load brolite.bro(it will load http.bro), and http\_ports is defined in http.bro as well, you may find the following lines -

# DPM configuration.

# global http\_ports = {

# 80/tcp, 81/tcp, 631/tcp, 3138/tcp,

# 8000/tcp, 8080/tcp, 8888/tcp,

# } &redef;

I comment them out, instead in snort.bro I comment out one line and add the similar config in http.bro

#const http\_ports = { 80/tcp, 8000/tcp, 8001/tcp, 8080/tcp };  
global http\_ports = {  
80/tcp, 81/tcp, 631/tcp, 3128/tcp,  
8000/tcp, 8080/tcp, 8888/tcp,  
} &redef;

Then try to run it again and see if it works.

Cheers

---

<div class="post-metadata">

**Author:** ![Miguel\_Angel\_Calvo\_M](https://avatars.discourse-cdn.com/v4/letter/m/ba9def/32.png) [@Miguel\_Angel\_Calvo\_M](https://community.zeek.org/u/Miguel_Angel_Calvo_M)\
**Post date:** [August 5, 2008, 8:42am UTC](https://community.zeek.org/t/bro-digest-vol-28-issue-2/1367/2 "2008-08-05T08:42:18Z")

</div>

> If u are using hostname.bro which may load brolite.bro(it will load http.bro), and http\_ports is defined in http.bro as well, you may find the following lines -
> 
> # DPM configuration.  
> # global http\_ports = {  
> # 80/tcp, 81/tcp, 631/tcp, 3138/tcp,  
> # 8000/tcp, 8080/tcp, 8888/tcp,  
> # } &redef;
> 
> I comment them out, instead in snort.bro I comment out one line and add the similar config in http.bro
> 
> #const http\_ports = { 80/tcp, 8000/tcp, 8001/tcp, 8080/tcp };  
> global http\_ports = {  
> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;80/tcp, 81/tcp, 631/tcp, 3128/tcp,  
> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;8000/tcp, 8080/tcp, 8888/tcp,  
> } &redef;
> 
> Then try to run it again and see if it works.

As you suggested I declared http\_posts at snort.bro as 'global' instead of 'const'. It did not work. Fortunately, when declaring http\_ports as

global http\_ports = {  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;80, 81, 631, 3128,  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;8000, 8080, 8888  
} &redef

without '/tcp' the signature works. Since 'ip-proto == tcp' is already set, the results will not differ, am I right?

Thank you  
Miguel

---

<div class="post-metadata">

**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\
**Post date:** [August 6, 2008, 12:07am UTC](https://community.zeek.org/t/bro-digest-vol-28-issue-2/1367/3 "2008-08-06T00:07:47Z")

</div>

Ah, I see. That's a bug. Can you try the attached patch and see if  
that solves the problem?

Robin

[ports.diff](https://community.zeek.org/uploads/short-url/sXTWJJC1HmtyCfHHVPsWCYR9SVL.diff) (531 Bytes)

---

<div class="post-metadata">

**Author:** ![Miguel\_Angel\_Calvo\_M](https://avatars.discourse-cdn.com/v4/letter/m/ba9def/32.png) [@Miguel\_Angel\_Calvo\_M](https://community.zeek.org/u/Miguel_Angel_Calvo_M)\
**Post date:** [August 6, 2008, 9:59am UTC](https://community.zeek.org/t/bro-digest-vol-28-issue-2/1367/4 "2008-08-06T09:59:07Z")

</div>

> > without ‘/tcp’ the signature works.
> 
> Ah, I see. That’s a bug. Can you try the attached patch and see if  
> that solves the problem?

Thank you Robin,

The patch did work.

Thank you  
Miguel

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:38pm UTC](https://community.zeek.org/t/bro-digest-vol-28-issue-2/1367/5 "2022-05-06T15:38:36Z")

</div>