[Bro] "services" variable referenced in known-services.bro

Earl Eiland earl.eiland at root9b.com
Fri Jun 5 11:46:25 PDT 2015

Thanks, Seth.

That helps a lot.  When I run DPD, the various logs show that traffic is being correctly parsed.  It seems that the information should appear in conn.log's service column, particularly when DPD is invoked from the command line.  This, however, is not the case.   What am I overlooking?

Best Regards,

Earl Eiland,
Sr. Cyber Security Engineer,
Emerging Technologies, root9B,
San Antonio, Texas

This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity named.  If you are not the named addressee you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.  Please notify the sender immediately by email if you received this email in error and delete this email from your system. Any views or opinions presented in this e-mail are solely those of the author and do not necessarily represent those of root9B LLC.​

From: Seth Hall <seth at icir.org>
Sent: Friday, June 5, 2015 1:20 PM
To: Earl Eiland
Cc: bro at bro.org
Subject: Re: [Bro] "services" variable referenced in known-services.bro

> On Jun 5, 2015, at 11:25 AM, Earl Eiland <earl.eiland at root9b.com> wrote:
> I'm using known-services to build a list of observed network conversations and the protocols being used.  Known-services detects the TCP conversations, but I want to include UDP conversations as well.  Known-services.bro seems to use a global variable, "services”;

The service field is a component of DPD (dynamic protocol detection) and the analyzer code in general.  You can find the script that actually populates that field here though:

That’s going to be a little misleading though because it’s just pulling data from deeper in the connection record into the log.  The real story is that this is done as part of DPD where protocols are guessed at with signatures and then a parser is attached.  Once the parser positively confirms that the protocol is in fact that protocol that the signature matched then it will indicate the service.

The right way to think about the service field is to think of it as an indicator that a connection was successfully analyzed by a particular analyzer.


Seth Hall
International Computer Science Institute
(Bro) because everyone has a network

More information about the Bro mailing list