Doubt between known_hosts log and known_services log

Zeek
1

Good morning,

I am checking that if we get the computers from the log known_hosts there are more computers compared to those found in known_services (I have obtained all the lines of this log and have left the single rows taking into account the ip of the computer).

I understand that this is because the script known_services to add a computer to its log, previously checks that the computer has at least one active service.
Am I right with this reason?

Thanks!

2

Yes, that’s what I would expect to be the answer. Hosts that are pure clients - they only initiate connections - won’t show up as providing services.

3

Thanks very much for your help!