For example, what if I run some proprietary service on
Is is going to be service 'other' or service 'http'? What if
I run telnetd on port 80?
Currently, this will be identified as "http".
Bro's TCP analyzers are being reworked so that in the future it will be
able to run alternate (or multiple) analyzers from that associated with
the well-known port. When that works, I think the above example would
have "telnet" as the service even though the responder port would be 80/tcp.