Re: Detecting software

Randy Labaza <[email protected]> Wed, 20 Nov 2019 14:28:45 -0500

Newsgroups	gmane.comp.security.detection.bro
Message-ID	<CAAsJwLXmxF5nJ_h3SfbtniZXma2uEOxnJvgq4w0zWttv2zpg_A@mail.gmail.com>

You might try some combination of lsof -i:4545, get the PID, then use ps to
find the process...
Regards.
rl.


On Wed, Nov 20, 2019 at 2:02 PM Vern Paxson <[email protected]> wrote:

> > We have a server that bro detected with port 4545 in listening mode. Is
> > there a way to find what software had that port opened or any specific
> > details about it?
>
> Zeek doesn't provide additional insight into servers running protocols for
> applications unknown to Zeek.  In practical terms, you could try capturing
> a pcap of the traffic and then inspecting it using say Wireshark to see
> if you can figure out what it is.
>
>                 Vern
> _______________________________________________
> Zeek mailing list
> [email protected]
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek
>

_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek