bro/bro — pull request #4 by mareq (2014-03-18 15:45:50+00:00)
Title: Protocol identification heuristics.

In case request is missing and Bro sees only response, it will use only destination port of response for analyzer lookup, which is incorrect in this case.

This attempts to solve that problem, by allowing Bro to use the packet origin port for lookup of relevant analyzers under certain circumstances (analyzer for destination port, which is higher than origin port, has not been found).

It might make sense to limit this to UDP only.