Re: Detecting software
Vern Paxson <[email protected]> Wed, 20 Nov 2019 10:54:07 -0800
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <[email protected]> |
> We have a server that bro detected with port 4545 in listening mode. Is > there a way to find what software had that port opened or any specific > details about it? Zeek doesn't provide additional insight into servers running protocols for applications unknown to Zeek. In practical terms, you could try capturing a pcap of the traffic and then inspecting it using say Wireshark to see if you can figure out what it is. Vern _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek