# Unknown protocol in Bro

**URL:** <https://community.zeek.org/t/unknown-protocol-in-bro/1281>\
**Category:** Zeek\
**Created:** [December 20, 2007, 5:07pm UTC](https://community.zeek.org/t/unknown-protocol-in-bro/1281 "2007-12-20T17:07:08Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Anton\_Korovin](https://avatars.discourse-cdn.com/v4/letter/a/df705f/32.png) [@Anton\_Korovin](https://community.zeek.org/u/Anton_Korovin)\
**Post date:** [December 20, 2007, 5:07pm UTC](https://community.zeek.org/t/unknown-protocol-in-bro/1281/1 "2007-12-20T17:07:08Z")

</div>

Hi!

I used Bro version 1.1.0.  
I wrote policy for dump data content, which is transferring on unknown protocol.  
And I modified method NewConn() in NetSessions class:  
If port value isn’t handled I create instance of UnknownConnection class,  
which fair events for each request/reply of its connection. These events are handled in policy script and write the content to HDD.

How can I do the same in new versions Bro?

Best regards,  
Anton Korovin

---

<div class="post-metadata">

**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\
**Post date:** [December 29, 2007, 1:00pm UTC](https://community.zeek.org/t/unknown-protocol-in-bro/1281/2 "2007-12-29T13:00:27Z")

</div>

The best location for such functionality should be  
DPM::BuildInitialAnalyzerTree() in DPM.{h,cc} (DPM is the "dynamic  
protocol manager()). In the new version of Bro, this method takes  
the initial decision which analyzers to use for a connection, in  
particular by checking whether there is a well-known port for any of  
the protocols Bro supports.

Instead of creating an UnknownConnection class, you can derive a  
class UnknownProtocolAnalyzer from class Analyzer and then add an  
instance of that in BuildInitialAnalyzerTree() to the connection's  
analyzer tree whenever there isn't any other analyzer to put in  
charge.

The drawback of this approach is that you'll also be writing content  
to disk for connections for which an analyzer is found later, e.g.,  
via DPD's signature matching. If that is a problem (i.e., you don't  
want to rely on well-known ports only for the content saving), an  
alternative would be to instantiate the UnknownProtocolAnalyzer  
later, e.g., only once the signature matching has been turned off.  
Until this point all content is buffered so you wouldn't loose  
anything. However, performance might affected somewhat with this  
approach if there are a lot of connections with unsupported  
protocols.

Let me know if you need more details on the DPD implementation.

Robin

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:38pm UTC](https://community.zeek.org/t/unknown-protocol-in-bro/1281/3 "2022-05-06T15:38:27Z")

</div>