[Bro] "services" variable referenced in known-services.bro

[Earl Eiland]

Hello.


I'm using known-services to build a list of observed network conversations and the protocols being used.  Known-services detects the TCP conversations, but I want to include UDP conversations as well.  Known-services.bro seems to use a global variable, "services"; services, however, does not hold UDP conversation protocol labels.  I've searched for the script that populates "services", to no avail.


Where do I find that script?  Alternatively, is there a better way to build an all-inclusive conversation vs. protocol mapping?


Best Regards,

Earl Eiland,
Sr. Cyber Security Engineer,
Emerging Technologies, root9B,
San Antonio, Texas

This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity named.  If you are not the named addressee you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.  Please notify the sender immediately by email if you received this email in error and delete this email from your system. Any views or opinions presented in this e-mail are solely those of the author and do not necessarily represent those of root9B LLC.?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20150605/d49de371/attachment.html