# Redefine const that does not have "&redef" attribute
**URL:** https://community.zeek.org/t/redefine-const-that-does-not-have-redef-attribute/3430
**Category:** Zeek
**Created:** [January 14, 2015, 3:53pm UTC](https://community.zeek.org/t/redefine-const-that-does-not-have-redef-attribute/3430 "2015-01-14T15:53:56Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Ward\_Sladek](https://community.zeek.org/u/Ward_Sladek)
#### Post date: [January 14, 2015, 3:53pm UTC](https://community.zeek.org/t/redefine-const-that-does-not-have-redef-attribute/3430/1 "2015-01-14T15:53:56Z")
I want to redefine Bro’s HTTP ports but I’m not having any luck…
The following code is in base/protocols/http/main.bro
**const ports = {**
**81/tcp, 631/tcp, 1080/tcp, 8000/tcp, 8888/tcp,**
**};**
**redef likely\_server\_ports += { ports };**
Here is what I’ve tried:
**redef HTTP::ports = {**
**81/tcp, 631/tcp, 1080/tcp, 8000/tcp, 8888/tcp,**
**};**
Which generates error “already defined (HTTP::ports)”… I also tried:
**const custom\_http\_ports = {**
**81/tcp, 631/tcp, 1080/tcp, 8000/tcp, 8888/tcp,**
**};**
**redef HTTP::likely\_server\_ports += { custom\_http\_ports };**
Which generates error ““redef” used but not previously defined (HTTP::likely\_server\_ports)”
A nudge in the right direction would be appreciated.
Thanks
---
### Author:  [@Hosom\_Stephen\_M](https://community.zeek.org/u/Hosom_Stephen_M)
#### Post date: [January 14, 2015, 5:06pm UTC](https://community.zeek.org/t/redefine-const-that-does-not-have-redef-attribute/3430/2 "2015-01-14T17:06:41Z")
Without the &redef flag set, you can’t redefine a constant. You would have to modify Bro’s HTTP scripts in order to make the change you are trying to make. That is generally a bad idea.
I suspect that you’re trying to get Bro to detect HTTP on a non-standard port. If this is the case, then you are likely already analyzing the traffic, as Bro dynamically detects HTTP running on any port and analyzes it all the same. Try capturing the non-standard HTTP and running it through Bro to see if it finds it, I’ll bet that it does.
The signatures that enable the HTTP analyzer on non-standard ports are located at bro/scripts/base/protocols/http/dpd.sig ( [https://github.com/bro/bro/blob/master/scripts/base/protocols/http/dpd.sig](https://github.com/bro/bro/blob/master/scripts/base/protocols/http/dpd.sig) ) . Don’t modify those either though.
If you truly have found an HTTP traffic pattern that Bro isn’t detecting, you should write a signature similar to these ones, and include ‘enable “http”’ like they have done here. Here’s a link to the documentation on signatures:
[https://www.bro.org/sphinx-git/frameworks/signatures.html](https://www.bro.org/sphinx-git/frameworks/signatures.html)
Let me know how it goes!
---
### Author:  [@Ward\_Sladek](https://community.zeek.org/u/Ward_Sladek)
#### Post date: [January 14, 2015, 6:14pm UTC](https://community.zeek.org/t/redefine-const-that-does-not-have-redef-attribute/3430/3 "2015-01-14T18:14:22Z")
Thanks for the references and tips, that helps… But I’m actually trying to do the opposite - instead of getting more detection, I’m trying to get less. I want to exclude port 80 as our proxy has that covered (essentially causing duplication in SIEM)…
---
### Author:  [@Hosom\_Stephen\_M](https://community.zeek.org/u/Hosom_Stephen_M)
#### Post date: [January 14, 2015, 6:26pm UTC](https://community.zeek.org/t/redefine-const-that-does-not-have-redef-attribute/3430/4 "2015-01-14T18:26:40Z")
That helps a lot. There are a lot of ways to solve your problem.
If you want to not analyze this traffic at all, I’d go the route of dropping the traffic with either your tap aggregation tool or a bpf in Bro. This would have the benefit of not using resources on traffic you’re not interested in. Documentation here: [https://www.bro.org/sphinx/scripts/base/frameworks/packet-filter/main.bro.html](https://www.bro.org/sphinx/scripts/base/frameworks/packet-filter/main.bro.html)
If you want to not log this traffic, but still analyze it, you can do this with log filters using the logging framework. The logging framework would also have the option of still logging the traffic, but logging it to a separate log. In this way, you could have pre-proxy-http.log and http.log (just for example). It’s incredibly flexible. Documentation here: [https://www.bro.org/development/logging.html#filtering](https://www.bro.org/development/logging.html#filtering)
There are probably other ways to accomplish what you want… but those are just a couple. It’s possible someone else will chime in with better solutions.
---
### Author:  [@system](https://community.zeek.org/u/system)
#### Post date: [May 6, 2022, 3:42pm UTC](https://community.zeek.org/t/redefine-const-that-does-not-have-redef-attribute/3430/5 "2022-05-06T15:42:21Z")