# How to do with Bro 2.1 **URL:** \ **Category:** Zeek\ **Created:** [October 5, 2012, 9:11pm UTC](https://community.zeek.org/t/how-to-do-with-bro-2-1/2456 "2012-10-05T21:11:05Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![keqhe](https://avatars.discourse-cdn.com/v4/letter/k/ed655f/32.png) [@keqhe](https://community.zeek.org/u/keqhe)\ **Post date:** [October 5, 2012, 9:11pm UTC](https://community.zeek.org/t/how-to-do-with-bro-2-1/2456/1 "2012-10-05T21:11:05Z")
Hello everyone: Bro 2.1 employs DPD to do application layer protocol classification. That is, it looks at the first few packet's payload to determine its service type. However, I notice that a large number of flows go through port 80 are considered as TCP not HTTP. We just want Bro to do application layer protocol classification based on port. What should I do? I hope that some people can give me some advice. Thank you! ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [October 6, 2012, 1:41am UTC](https://community.zeek.org/t/how-to-do-with-bro-2-1/2456/2 "2012-10-06T01:41:47Z")
> Bro 2.1 employs DPD to do application layer protocol classification. That > is, it looks at the first few packet's payload to determine its service > type. Here's the paper that describes it in more detail if this helps:   [http://www.icir.org/robin/papers/usenix06.pdf](http://www.icir.org/robin/papers/usenix06.pdf) > However, I notice that a large number of flows go through port 80 are > considered as TCP not HTTP. We just want Bro to do application layer > protocol classification based on port. What should I do? I think you're going to have to describe more about what you are actually seeing that you think is incorrect. TCP and HTTP are different classes of protocol anyway since TCP is transport and HTTP is application. Bro should be identifying supported protocols on any port and attaching an appropriate analyzer if one exists.   .Seth ---
**Author:** ![keqhe](https://avatars.discourse-cdn.com/v4/letter/k/ed655f/32.png) [@keqhe](https://community.zeek.org/u/keqhe)\ **Post date:** [October 6, 2012, 3:59am UTC](https://community.zeek.org/t/how-to-do-with-bro-2-1/2456/3 "2012-10-06T03:59:32Z")
> > Bro 2.1 employs DPD to do application layer protocol classification. > > That > > is, it looks at the first few packet's payload to determine its service > > type. > > Here's the paper that describes it in more detail if this helps: >   [http://www.icir.org/robin/papers/usenix06.pdf](http://www.icir.org/robin/papers/usenix06.pdf) > > > However, I notice that a large number of flows go through port 80 are > > considered as TCP not HTTP. We just want Bro to do application layer > > protocol classification based on port. What should I do? > > I think you're going to have to describe more about what you are actually > seeing that you think is incorrect. TCP and HTTP are different classes of > protocol anyway since TCP is transport and HTTP is application. Bro > should be identifying supported protocols on any port and attaching an > appropriate analyzer if one exists. > >   .Seth > > -- > Seth Hall > International Computer Science Institute > (Bro) because everyone has a network > [http://www.bro-ids.org/](http://www.bro-ids.org/) Hello Seth: Thank you for your information, I have read the paper you mentioned. I am wondering whether it is possible for Bro to do traffic analysis just based on port. For example, traffic goes through port 80 is regarded as http in traffic analysis. However, there are a large number of http handshake flows such as "SYN-SYN/ACK-ACK". These flows mean there is no data, but strictly speaking, they should be regarded as http traffic although they carry no data. However, Bro2.1 just view these kinds of flows as tcp. Can users modify its default standard for http? I mean how to modify the event trigger for a certain application service. For example, if some user just want to use port number to trigger http traffic analyzer, what should us users do? Is there any information for this kinds of requirements? Besides, I observe that Bro2.1 can only classify flows who can complete three-way handshake successfully. If the flow is incomplete, Bro 2.1 do nothing to try to identify application layer protocols. Is it possible for us users to modify this? Thank again! Keqiang ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [October 6, 2012, 4:26am UTC](https://community.zeek.org/t/how-to-do-with-bro-2-1/2456/4 "2012-10-06T04:26:21Z")
> > However, there are a large number of http > > handshake flows such as "SYN-SYN/ACK-ACK". These flows mean there is no > data, but strictly speaking, they should be regarded as http traffic > although they carry no data. I don't agree that it should be regarded as HTTP traffic. Just because you have a wine glass doesn't mean it's full of wine. 🙂 Typically the "service" field in the conn log is supposed to be understood as the protocol analyzer or analyzers that Bro used upon the connection successfully (since it can try analyzers and allow them to fail then remove them). > Besides, I observe that Bro2.1 can only classify flows who can complete > three-way handshake successfully. If the flow is incomplete, Bro 2.1 do > nothing to try to identify application layer protocols. Is it possible > for us users to modify this? This is a known issue and something that we've been planning on addressing in a generic way soon so that the analyzers will be able to "re-sync" to the traffic. There is a ticket somewhere in our tracker about it.   .Seth ---
**Author:** ![keqhe](https://avatars.discourse-cdn.com/v4/letter/k/ed655f/32.png) [@keqhe](https://community.zeek.org/u/keqhe)\ **Post date:** [October 6, 2012, 3:55pm UTC](https://community.zeek.org/t/how-to-do-with-bro-2-1/2456/5 "2012-10-06T15:55:48Z")
> > > However, there are a large number of http > > > > handshake flows such as "SYN-SYN/ACK-ACK". These flows mean there is no > > data, but strictly speaking, they should be regarded as http traffic > > although they carry no data. > > I don't agree that it should be regarded as HTTP traffic. Just because > you have a wine glass doesn't mean it's full of wine. 🙂 > > Typically the "service" field in the conn log is supposed to be understood > as the protocol analyzer or analyzers that Bro used upon the connection > successfully (since it can try analyzers and allow them to fail then > remove them). > > > Besides, I observe that Bro2.1 can only classify flows who can complete > > three-way handshake successfully. If the flow is incomplete, Bro 2.1 do > > nothing to try to identify application layer protocols. Is it possible > > for us users to modify this? > > This is a known issue and something that we've been planning on addressing > in a generic way soon so that the analyzers will be able to "re-sync" to > the traffic. There is a ticket somewhere in our tracker about it. > >   .Seth > > -- > Seth Hall > International Computer Science Institute > (Bro) because everyone has a network > [http://www.bro-ids.org/](http://www.bro-ids.org/) Hello, sorry to disturb you again. Do you know is there any document guiding users to make http or https's identification just based on port number. In other words, how to disable http and https signature matching function? Bro does more than we expected, can we make his standard of judging http and https weaker? ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [October 7, 2012, 3:08am UTC](https://community.zeek.org/t/how-to-do-with-bro-2-1/2456/6 "2012-10-07T03:08:35Z")
Here's a script that does what you want…   [https://github.com/sethhall/bro-scripts/blob/master/conn-port-service.bro](https://github.com/sethhall/bro-scripts/blob/master/conn-port-service.bro) .Seth ---
**Author:** ![William\_Jones](https://avatars.discourse-cdn.com/v4/letter/w/8dc957/32.png) [@William\_Jones](https://community.zeek.org/u/William_Jones)\ **Post date:** [October 10, 2012, 7:45pm UTC](https://community.zeek.org/t/how-to-do-with-bro-2-1/2456/7 "2012-10-10T19:45:09Z")
Bill Jones ---
**Author:** ![Mike\_Sconzo](https://avatars.discourse-cdn.com/v4/letter/m/d6d6ee/32.png) [@Mike\_Sconzo](https://community.zeek.org/u/Mike_Sconzo)\ **Post date:** [October 10, 2012, 10:55pm UTC](https://community.zeek.org/t/how-to-do-with-bro-2-1/2456/8 "2012-10-10T22:55:21Z")
I've got another question on DPD (or at least on the implementation). For example, [http://www.bro-ids.org/documentation/scripts/base/protocols/http/file-extract.html](http://www.bro-ids.org/documentation/scripts/base/protocols/http/file-extract.html) adds ports to the DPD config. Does this mean that Bro only uses DPD on traffic over those ports added to the ports list? If we want/know of HTTP traffic over ports other than those we should add additional ports to the list or does DPD just "figure things out"(tm) and do what it does best on any port? Thanks! ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [October 11, 2012, 12:55am UTC](https://community.zeek.org/t/how-to-do-with-bro-2-1/2456/9 "2012-10-11T00:55:25Z")
No, DPD has two operating heuristics. One heuristic which has been the focus of this thread is the port. The other heuristic is the signatures which current reside here: [http://git.bro-ids.org/bro.git/blob/HEAD:/scripts/base/frameworks/dpd/dpd.sig](http://git.bro-ids.org/bro.git/blob/HEAD:/scripts/base/frameworks/dpd/dpd.sig) Analyzers will be attached to connections with the dpd\_config variable and by signatures (multiple analyzers can simultaneously receive the data). Typically if more than one analyzer are instantiated for a connection, one of them will fail and be removed from the connection. Does that clarify things more? I think that what you want to happen is in fact what's happening.   .Seth ---
**Author:** ![Mike\_Sconzo](https://avatars.discourse-cdn.com/v4/letter/m/d6d6ee/32.png) [@Mike\_Sconzo](https://community.zeek.org/u/Mike_Sconzo)\ **Post date:** [October 11, 2012, 1:19am UTC](https://community.zeek.org/t/how-to-do-with-bro-2-1/2456/10 "2012-10-11T01:19:22Z")
Thanks. You're correct, what I want to happen appears to be happening. Is it a horrible idea to change the signatures? I was curious about adding more client verbs in HTTP to detect webdav, and or adding an additional http client sig that operates on UDP mostly for upnp detection. ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [October 11, 2012, 2:00am UTC](https://community.zeek.org/t/how-to-do-with-bro-2-1/2456/11 "2012-10-11T02:00:11Z")
You could just write your own signatures (remembering that we don't recommend modifying scripts in base/) and load it in local.bro. I'll give an example… In a file named localdpd.sig: signature my\_dpd\_http\_client {   ip-proto == tcp   payload /^[[:space:]]\*(PUT)[[:space:]]\*/   tcp-state originator } signature my\_dpd\_http\_server {   ip-proto == tcp   payload /^HTTP\/[0-9]/   tcp-state responder   requires-reverse-signature my\_dpd\_http\_client   enable "http" } Then in local.bro: @loads-sigs ./localdpd.sig If you find that some of your signature additions are valuable, then we would certainly be willing to integrate them into Bro. I think this provides us a good way of trying things out first. 🙂   .Seth ---
**Author:** ![Mike\_Sconzo](https://avatars.discourse-cdn.com/v4/letter/m/d6d6ee/32.png) [@Mike\_Sconzo](https://community.zeek.org/u/Mike_Sconzo)\ **Post date:** [October 11, 2012, 2:06am UTC](https://community.zeek.org/t/how-to-do-with-bro-2-1/2456/12 "2012-10-11T02:06:55Z")
Perfect, thanks! ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:40pm UTC](https://community.zeek.org/t/how-to-do-with-bro-2-1/2456/13 "2022-05-06T15:40:36Z")