Splunk App for Stream: Where can I find a complete list of protocols automatically detected in the "app" field of stream:tcp?

[kwchang_splunk]

Hello,

As described in the following stream product document, the 'app' field of stream:tcp has the detected protocol name automatically, like "tor", "bittorent" or "skype".
http://docs.splunk.com/Documentation/StreamApp/6.4.0/DeployStreamApp/Whattypeofdatadoesthisappcollec...

BTW, where can I find the complete list of the protocols which can be detected automatically?

Thank you in advance.

[vshcherbakov_sp · Accepted solution]

Hi kwchang,

I created a ticket to properly document the list of classified protocols; meanwhile please find the preliminary list below (please keep in mind that it's preliminary and subject to change, etc.):

8021q
aim
amqp
bgp
bittorrent
cotp
db2
dcerpc
dhcp
diameter
dns
drda
ftp
gmail
google_gen
gre
http
https
http_tunnel
ica
imap
informix
ipx
irc
iscsi
jabber
krb5
ldap
llc
mapi
mcs
mq
msn
msrpc
mount
mysql
netbios
netflow
nfs
pop3
postgres
radius
rdp
rip1
rip2
rpc
rtp
sip
skype
smb
smpp
smtp
sna
snmp
socks4
socks5
ssh
ssl
stun
syslog
tcp
tds
telnet
tftp
tns
tor
udp
wins

[kwchang_splunk]

Thank you.

[kwchang_splunk]

It would be good if the document will contain short descriptions about the each of those and also about the related protocol parsers which we can use for parsing it with (if app=jabber, we can use XMPP for parsing the details).