Hi all,
We have a server that bro detected with port 4545 in listening mode. Is there a way to find what software had that port opened or any specific details about it?
Thanks
Monah
We have a server that bro detected with port 4545 in listening mode. Is
there a way to find what software had that port opened or any specific
details about it?
Zeek doesn't provide additional insight into servers running protocols for
applications unknown to Zeek. In practical terms, you could try capturing
a pcap of the traffic and then inspecting it using say Wireshark to see
if you can figure out what it is.
Vern
You might try some combination of lsof -i:4545, get the PID, then use ps to find the process…
Just to be clear, Randy’s suggestions should be executed on the server listening on port 4545, not the bro/zeek system.