I’ve been scouring the bro scripts, technical papers, etc., to determine how to map and monitor node conversations vs. communications (service) protocols on a network. I could use information in conn.log, if the services column was fully populated. Unfortunately, it doesn’t appear that the services variable entered in the conn.log comes from the protocol detection scripts. I’m new to bro, so it’s quite possible I’ve missed something, but it is looking like I may have to modify the bro source code. Please advise!