new bro "CURRENT" release - 0.8a57
vern at icir.org
Tue Dec 16 14:17:50 PST 2003
> For example, what if I run some proprietary service on port 80?
> Is is going to be service 'other' or service 'http'? What if
> I run telnetd on port 80?
Currently, this will be identified as "http".
Bro's TCP analyzers are being reworked so that in the future it will be
able to run alternate (or multiple) analyzers from that associated with
the well-known port. When that works, I think the above example would
have "telnet" as the service even though the responder port would be 80/tcp.
More information about the Bro