# what application layer protocols could Bro-2.1 identify using its default configuration?

**URL:** <https://community.zeek.org/t/what-application-layer-protocols-could-bro-2-1-identify-using-its-default-configuration/2441>\
**Category:** Zeek\
**Created:** [September 19, 2012, 2:05pm UTC](https://community.zeek.org/t/what-application-layer-protocols-could-bro-2-1-identify-using-its-default-configuration/2441 "2012-09-19T14:05:42Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Hui\_Lin](https://avatars.discourse-cdn.com/v4/letter/h/13edae/32.png) [@Hui\_Lin](https://community.zeek.org/u/Hui_Lin)\
**Post date:** [September 19, 2012, 2:05pm UTC](https://community.zeek.org/t/what-application-layer-protocols-could-bro-2-1-identify-using-its-default-configuration/2441/1 "2012-09-19T14:05:42Z")

</div>

The answer to your question can be very complex.

First, Bro’s application layer analyzer can be written by binpac or directly by c++ (in src, \*.pac codes are the binpac scripts, so you can know what analyzers are written by binpac). Most analyzer developed in the early stage is directly written by C++, for those codes, how they are enabled, I am not quite sure. For binpac analyzer, there are three ways of enabling a analyzer, which can be found in [http://www.bro-ids.org/development/dpd.html](http://www.bro-ids.org/development/dpd.html) (Determining Analyzer Activation ).

Even if the binpac analyzer is always enabled, it may not be working if you don’t define any event handler related to this analyzer. As a result, you have to check what policies are loaded by default, which can be found in /share/bro/base under bro’s installation directory (not source code directory).

---

<div class="post-metadata">

**Author:** ![keqhe](https://avatars.discourse-cdn.com/v4/letter/k/ed655f/32.png) [@keqhe](https://community.zeek.org/u/keqhe)\
**Post date:** [September 19, 2012, 4:03pm UTC](https://community.zeek.org/t/what-application-layer-protocols-could-bro-2-1-identify-using-its-default-configuration/2441/2 "2012-09-19T16:03:32Z")

</div>

HI, Hui:

Thank you very much for your information!

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:40pm UTC](https://community.zeek.org/t/what-application-layer-protocols-could-bro-2-1-identify-using-its-default-configuration/2441/3 "2022-05-06T15:40:34Z")

</div>