[Bro-Dev] #576: Conn.log does not use well known ports for service field anymore

Bro Tracker bro at tracker.bro-ids.org
Wed Aug 31 07:26:22 PDT 2011


#576: Conn.log does not use well known ports for service field anymore
------------------------------+--------------------
  Reporter:  gregor           |      Owner:
      Type:  Feature Request  |     Status:  new
  Priority:  Normal           |  Milestone:  Bro1.6
 Component:  Bro              |    Version:
Resolution:                   |   Keywords:  BETA
------------------------------+--------------------

Comment (by seth):

 > The new conn.log does not use well known ports for the service field
 > anymore. I actually found this feature quite convenient to have. Can we
 > get it back? Maybe by adding an additional column that specifies whether
 > the service field is derived from DPD or port based. Or we have a
 > "dpd_service" column and a "port_service" column.

 Would it work for you if that was just included as an extension script
 instead of being included in the base script?

-- 
Ticket URL: <http://tracker.bro-ids.org/bro/ticket/576#comment:0>
Bro Tracker <http://tracker.bro-ids.org/bro>
Bro Issue Tracker



More information about the bro-dev mailing list