# bro for application identification

**URL:** <https://community.zeek.org/t/bro-for-application-identification/1558>\
**Category:** Zeek\
**Created:** [December 4, 2009, 12:50pm UTC](https://community.zeek.org/t/bro-for-application-identification/1558 "2009-12-04T12:50:20Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Charalampos\_Rotsos](https://avatars.discourse-cdn.com/v4/letter/c/d6d6ee/32.png) [@Charalampos\_Rotsos](https://community.zeek.org/u/Charalampos_Rotsos)\
**Post date:** [December 4, 2009, 12:50pm UTC](https://community.zeek.org/t/bro-for-application-identification/1558/1 "2009-12-04T12:50:20Z")

</div>

Hi,  
I am trying to use bro for payload based application identification from  
a pcap trace. I am currently loading the following bro files:  
dpd, conn, bittorrent, dhcp, dns, ftp, gnutella, http, ident, icmp,  
irc, login, nfs, ntp, pop3, rsh, ssh, tcp, smtp, tftp, udp

and use the conn.log file to check the label of a flow.

Is there a better to perform this task?

Haris.

---

<div class="post-metadata">

**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\
**Post date:** [December 6, 2009, 11:38pm UTC](https://community.zeek.org/t/bro-for-application-identification/1558/2 "2009-12-06T23:38:19Z")

</div>

> dpd, conn, bittorrent, dhcp, dns, ftp, gnutella, http, ident, icmp,  
> irc, login, nfs, ntp, pop3, rsh, ssh, tcp, smtp, tftp, udp
> 
> and use the conn.log file to check the label of a flow.

That works, but make sure to set dpd\_conn\_logs in conn.bro to true  
to have the DPD-information actually show up in the service field  
(the default there is still port-based classification, for backwards  
compatibility).

Also note that not all protocol analyzers already support DPD, so  
for some from your list above, you will not see any DPD results.  
(The quick hack to find out which ones are supported is "grep  
ProtocolConfirmation src/\*.cc").

> Is there a better to perform this task?

It depends on what you want to use the results for. If the  
connection log has all you need, then this makes sense. There's also  
detect-protocols.bro to report protocols on non-standard ports via  
Notices. And there are hooks into the protocol detection if you need  
more control; the protocol\_{confirmation,violation} events inform  
you about what DPD finds.

Robin

---

<div class="post-metadata">

**Author:** ![Charalampos\_Rotsos](https://avatars.discourse-cdn.com/v4/letter/c/d6d6ee/32.png) [@Charalampos\_Rotsos](https://community.zeek.org/u/Charalampos_Rotsos)\
**Post date:** [December 8, 2009, 11:14am UTC](https://community.zeek.org/t/bro-for-application-identification/1558/3 "2009-12-08T11:14:44Z")

</div>

Robin Sommer wrote:

> > dpd, conn, bittorrent, dhcp, dns, ftp, gnutella, http, ident, icmp,  
> > irc, login, nfs, ntp, pop3, rsh, ssh, tcp, smtp, tftp, udp
> > 
> > and use the conn.log file to check the label of a flow.  
> > &nbsp;&nbsp;&nbsp;&nbsp;  
> > That works, but make sure to set dpd\_conn\_logs in conn.bro to true  
> > to have the DPD-information actually show up in the service field  
> > (the default there is still port-based classification, for backwards  
> > compatibility).
> 
> Also note that not all protocol analyzers already support DPD, so  
> for some from your list above, you will not see any DPD results.  
> (The quick hack to find out which ones are supported is "grep  
> ProtocolConfirmation src/\*.cc").
> 
> > Is there a better to perform this task?  
> > &nbsp;&nbsp;&nbsp;&nbsp;  
> > It depends on what you want to use the results for. If the  
> > connection log has all you need, then this makes sense. There's also  
> > detect-protocols.bro to report protocols on non-standard ports via  
> > Notices. And there are hooks into the protocol detection if you need  
> > more control; the protocol\_{confirmation,violation} events inform  
> > you about what DPD finds.  
> > &nbsp;&nbsp;  
> > What I want to do is to ground truth a network trace. I want to use as  
> > many protocol analysers as possible in order to reduce the manual  
> > verification of the label.

In case I load the detect-protocols script, I will see the results of  
the analysis on conn.log?

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:38pm UTC](https://community.zeek.org/t/bro-for-application-identification/1558/4 "2022-05-06T15:38:59Z")

</div>

Closed on May 6, 2022, 3:38pm UTC