# DPD not getting expected results **URL:** \ **Category:** Zeek\ **Created:** [January 12, 2009, 9:39pm UTC](https://community.zeek.org/t/dpd-not-getting-expected-results/1476 "2009-01-12T21:39:14Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Eric\_Thomas](https://avatars.discourse-cdn.com/v4/letter/e/96bed5/32.png) [@Eric\_Thomas](https://community.zeek.org/u/Eric_Thomas)\ **Post date:** [January 12, 2009, 9:39pm UTC](https://community.zeek.org/t/dpd-not-getting-expected-results/1476/1 "2009-01-12T21:39:14Z")
I'm running bro in offline mode (-r) trying to get various aspects of DPD to work. I needed a good trace to test, so I configured system B's SSH to run on ports 22, 23, and 80. Then I got a packet trace (tcpdump -w) while SSH'ing from system A to those three ports on system B. I ran bro on the trace with the following policy files (in this order): notice conn dpd irc-bot dyn-disable detect-protocols detect-protocols-http proxy http-request http-reply ssh zzz-custom zzz-custom is my custom policy file for redefs. In that file I redef'd dpd\_conn\_logs to T and ensured an all-inclusive capture\_filter. The results are not what I was hoping for. I expected, because I enabled dpd\_conn\_logs, that SSH would be properly detected and the conn log would indicate that. Instead, there is a ? appended after the name of the port, which indicates the protocol wasn't parsed. I expected to see ProtocolViolation messages in the notice log because of the non-http protocol on port 80 (this is a feature of dyn-disable). And I expected to see ProtocolFound and ServerFound notices because of the SSH protocol on a non-standard port (according to the wiki, that code is in detect-protocols.bro). None of the three things I expected to happen happened. My notice log is completely empty. And the conn log has the three connections I expected (albiet with the missing detected protocol). I'm running bro 1.4. Any ideas on what I'm doing wrong here? Eric T [edthoma@sandia.gov](mailto:edthoma@sandia.gov) ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [January 13, 2009, 12:58am UTC](https://community.zeek.org/t/dpd-not-getting-expected-results/1476/2 "2009-01-13T00:58:28Z")
Can you send me the trace file as well as your zzz-custom please? Robin ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [January 13, 2009, 9:43pm UTC](https://community.zeek.org/t/dpd-not-getting-expected-results/1476/3 "2009-01-13T21:43:45Z")
(For the record, this turns out to be a problem with the trace file.) Robin ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:38pm UTC](https://community.zeek.org/t/dpd-not-getting-expected-results/1476/4 "2022-05-06T15:38:50Z")