# Detecting software

**URL:** https://community.zeek.org/t/detecting-software/5908
**Category:** Zeek
**Created:** [November 20, 2019, 4:49pm UTC](https://community.zeek.org/t/detecting-software/5908 "2019-11-20T16:49:41Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Monah\_Baki](https://avatars.discourse-cdn.com/v4/letter/m/d6d6ee/32.png) [@Monah\_Baki](https://community.zeek.org/u/Monah_Baki)
#### Post date: [November 20, 2019, 4:49pm UTC](https://community.zeek.org/t/detecting-software/5908/1 "2019-11-20T16:49:41Z")

</div>

Hi all,

We have a server that bro detected with port 4545 in listening mode. Is there a way to find what software had that port opened or any specific details about it?

Thanks  
Monah

---

<div class="post-metadata">

### Author: ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)
#### Post date: [November 20, 2019, 6:54pm UTC](https://community.zeek.org/t/detecting-software/5908/2 "2019-11-20T18:54:07Z")

</div>

> We have a server that bro detected with port 4545 in listening mode. Is  
> there a way to find what software had that port opened or any specific  
> details about it?

Zeek doesn't provide additional insight into servers running protocols for  
applications unknown to Zeek. In practical terms, you could try capturing  
a pcap of the traffic and then inspecting it using say Wireshark to see  
if you can figure out what it is.

&nbsp;&nbsp;&nbsp;&nbsp;Vern

---

<div class="post-metadata">

### Author: ![Randy\_Labaza](https://avatars.discourse-cdn.com/v4/letter/r/439d5e/32.png) [@Randy\_Labaza](https://community.zeek.org/u/Randy_Labaza)
#### Post date: [November 20, 2019, 7:28pm UTC](https://community.zeek.org/t/detecting-software/5908/3 "2019-11-20T19:28:45Z")

</div>

You might try some combination of lsof -i:4545, get the PID, then use ps to find the process…

---

<div class="post-metadata">

### Author: ![Jim\_Mellander](https://avatars.discourse-cdn.com/v4/letter/j/e47c2d/32.png) [@Jim\_Mellander](https://community.zeek.org/u/Jim_Mellander)
#### Post date: [November 20, 2019, 7:54pm UTC](https://community.zeek.org/t/detecting-software/5908/4 "2019-11-20T19:54:13Z")

</div>

Just to be clear, Randy’s suggestions should be executed on the server listening on port 4545, not the bro/zeek system.

---

<div class="post-metadata">

### Author: ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)
#### Post date: [May 6, 2022, 3:46pm UTC](https://community.zeek.org/t/detecting-software/5908/5 "2022-05-06T15:46:53Z")

</div>