# reliable off-line protocol detection

**URL:** <https://community.zeek.org/t/reliable-off-line-protocol-detection/838>\
**Category:** Zeek\
**Created:** [August 23, 2005, 10:47am UTC](https://community.zeek.org/t/reliable-off-line-protocol-detection/838 "2005-08-23T10:47:14Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Manuel\_Crotti](https://avatars.discourse-cdn.com/v4/letter/m/94ad74/32.png) [@Manuel\_Crotti](https://community.zeek.org/u/Manuel_Crotti)\
**Post date:** [August 23, 2005, 10:47am UTC](https://community.zeek.org/t/reliable-off-line-protocol-detection/838/1 "2005-08-23T10:47:14Z")

</div>

Ciao,  
I’m trying to make protocol detection on non-standart ports.

I set-up a apaci server on 777 and a mail server (postfix) on 778.  
I captured packets with tcpdump.  
I parsed dumps with a “bro -C -r protocolName.dump backdoor”

those are the “backdoor.log” results:

http.dump

> 1124720330.438091 10.20.188.212/32770 \> 10.20.10.34/777 http-sig  
> 1124720338.627503 10.20.188.212/32773 \> 10.20.10.34/777 http-sig  
> 1124720425.113738 10.20.188.212/32784 \> 10.20.10.34/777 http-sig

smtp.dump

> 1124785239.632272 127.0.0.1/56034 \> 127.0.0.1/778 ftp-sig  
> 1124785306.080354 127.0.0.1/56037 \> 127.0.0.1/778 ftp-sig  
> 1124785591.602025 127.0.0.1/56048 \> 127.0.0.1/778 ftp-sig  
> 1124785606.143460 127.0.0.1/56050 \> 127.0.0.1/778 ftp-sig

WHY? ( ©1992 Annie Lennox)

Best regards,  
Manuel.

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:37pm UTC](https://community.zeek.org/t/reliable-off-line-protocol-detection/838/2 "2022-05-06T15:37:38Z")

</div>