A strange connection

Zeek
1

I saw a strange connection in a connection log. In this connection, the original bytes
are 114,502,461, but most of the bytes are simply missing (114,502,154 bytes
according to the missed bytes field). The original IP bytes are relatively few
(only 519 bytes). What is the possible cause of the large sequence gap? Is it due to
capture loss? Thanks.

1419498119.991707 CLQP0QdahFaFha0U2 140.x.x.x 58967 66.171.248.x 80 tcp http 253.220343 114502461 592490922 SF T 114502154 ShADadfF 5 519 6 578 (empty)

Po-Ching

2

Is this by any chance a SF scan ? If this were a normal connection won't
we be seeing an Ack Flag, Push Flag in addition to the SF noted above ?

3

Dear Balasubramania,

The history field is ShADAdfF, so I think it is a normal connection. SF just means
normal establishment and termination.

Po-Ching