Does packet beat work for custom ports or custom protocols?

Elastic Stack Beats
1

Hi

Does packet beat work for custom ports or custom protocols?

Thanks

2

Custom ports will work for any of the existing protocols, but you need to build your own beat for any protocol we don't have one for.

3

Hello thanks for prompt reply,

I have socks v5 protocol will it trace packets for it?

Thanks

4

Not currently.

5

@rabeetwaqar which kind of data would you expect to be reported for socks v5 protocol (RFC)? underlying TCP/UDP connection stats to socks server port? Socks protocol level connections and requests? Dynamic 'port' registration in other protocol modules to handle connections brokered by socks protocol?

For generic underlying TCP/UDP stats you can follow the github issue.

All higher level protocols require parsers and message correlators to be written. Feel free to open a github issue or send us a pull request (maybe create the github issue for discussions first). Supporting socks v5 (and other 'broker like' connection enablement protocols) sounds very interesting, but will take some more planning and implementation wise.