Skip to content

Instantly share code, notes, and snippets.

@Ivlyth
Created January 2, 2018 11:41
Show Gist options
  • Save Ivlyth/4a3b9eb02568b6e9635d717965ccd6f5 to your computer and use it in GitHub Desktop.
Save Ivlyth/4a3b9eb02568b6e9635d717965ccd6f5 to your computer and use it in GitHub Desktop.
find all bro analyzers
grep --include "*.bro" -r -e "register_for_ports" * | grep register_for_ports | grep -v call | grep "::ANALYZER_" | awk -F 'ANALYZER_' '{print $2}' | awk -F ',' '{print $1}' | sort
# results 27. bro-2.5.1
AYIYA
DCE_RPC
DHCP
DNP3_TCP
DNS
DTLS
FTP
GTPV1
HTTP
IMAP
IRC
KRB
KRB_TCP
MODBUS
MYSQL
RADIUS
RDP
SIP
SMB
SMTP
SNMP
SOCKS
SSH
SSL
SYSLOG
TEREDO
XMPP
@Ivlyth
Copy link
Author

Ivlyth commented Jan 4, 2018

[Analyzer::ANALYZER_SMTP] = {587/tcp,25/tcp},
[Analyzer::ANALYZER_MODBUS] = {502/tcp},
[Analyzer::ANALYZER_SSL] = {443/tcp,614/tcp,995/tcp,636/tcp,992/tcp,993/tcp,990/tcp,5223/tcp,989/tcp,563/tcp,585/tcp},
[Analyzer::ANALYZER_DNS] = {137/udp,5355/udp,5353/udp,53/tcp,53/udp},
[Analyzer::ANALYZER_AYIYA] = {5072/udp},
[Analyzer::ANALYZER_GTPV1] = {2123/udp,2152/udp},
[Analyzer::ANALYZER_KRB_TCP] = {88/tcp},
[Analyzer::ANALYZER_RDP] = {3389/tcp},
[Analyzer::ANALYZER_SNMP] = {161/udp,162/udp},
[Analyzer::ANALYZER_DCE_RPC] = {135/tcp},
[Analyzer::ANALYZER_IMAP] = {143/tcp},
[Analyzer::ANALYZER_RADIUS] = {1812/udp},
[Analyzer::ANALYZER_DNP3_TCP] = {20000/udp,20000/tcp},
[Analyzer::ANALYZER_MYSQL] = {1434/tcp,3306/tcp},
[Analyzer::ANALYZER_SIP] = {5060/udp},
[Analyzer::ANALYZER_KRB] = {88/udp},
[Analyzer::ANALYZER_DHCP] = {67/udp,68/udp},
[Analyzer::ANALYZER_FTP] = {2811/tcp,21/tcp},
[Analyzer::ANALYZER_TEREDO] = {3544/udp},
[Analyzer::ANALYZER_SYSLOG] = {514/udp},
[Analyzer::ANALYZER_DTLS] = {443/udp},
[Analyzer::ANALYZER_HTTP] = {1080/tcp,8080/tcp,81/tcp,3128/tcp,8888/tcp,80/tcp,631/tcp,8000/tcp},
[Analyzer::ANALYZER_XMPP] = {5222/tcp,5269/tcp},
[Analyzer::ANALYZER_IRC] = {6667/tcp,6666/tcp,6669/tcp,6668/tcp},
[Analyzer::ANALYZER_SSH] = {22/tcp},
[Analyzer::ANALYZER_SOCKS] = {1080/tcp}

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment