# General questions about Bro's capabilities **URL:** \ **Category:** Zeek\ **Created:** [December 28, 2014, 4:44pm UTC](https://community.zeek.org/t/general-questions-about-bros-capabilities/3406 "2014-12-28T16:44:24Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Savakh\_S](https://avatars.discourse-cdn.com/v4/letter/s/278dde/32.png) [@Savakh\_S](https://community.zeek.org/u/Savakh_S)\ **Post date:** [December 28, 2014, 4:44pm UTC](https://community.zeek.org/t/general-questions-about-bros-capabilities/3406/1 "2014-12-28T16:44:24Z")
Hello, How can Bro be used to set a network profile and works as a behavior IDS ? Does Bro need to understand L7 protocols ? Is it compulsory ? If not, what would be its capabilities ? Thank for your answers. Regards. ---
**Author:** ![anthony\_kasza1](https://avatars.discourse-cdn.com/v4/letter/a/dfb087/32.png) [@anthony\_kasza1](https://community.zeek.org/u/anthony_kasza1)\ **Post date:** [December 28, 2014, 11:43pm UTC](https://community.zeek.org/t/general-questions-about-bros-capabilities/3406/2 "2014-12-28T23:43:24Z")
Bro has an understanding of many of the more popular layer 7 protocols and is able to generate logs based on what it sees. One rather simple way to create a baseline for a network could be to monitor the network for a period of time and observe the logs Bro generates. -AK ---
**Author:** ![Hui\_Lin](https://avatars.discourse-cdn.com/v4/letter/h/13edae/32.png) [@Hui\_Lin](https://community.zeek.org/u/Hui_Lin)\ **Post date:** [December 29, 2014, 3:01am UTC](https://community.zeek.org/t/general-questions-about-bros-capabilities/3406/3 "2014-12-29T03:01:21Z")
Hi Savakh, The analyzer for specific protocols are included in src\analyzer\protocol of the source code repository . You may also take a look at Binpac ([https://www.bro.org/sphinx/components/binpac/README.html](https://www.bro.org/sphinx/components/binpac/README.html)). Most current application layer protocols based on TCP or UDP are added in Bro by using Binpac. With the help of Binpac, it is also easy to add new protocol analyzer in Bro. Hope this helps. Hugo ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:42pm UTC](https://community.zeek.org/t/general-questions-about-bros-capabilities/3406/4 "2022-05-06T15:42:19Z")