# About selectively dumping traffic packets from specific connections during live analysis

**URL:** <https://community.zeek.org/t/about-selectively-dumping-traffic-packets-from-specific-connections-during-live-analysis/7156>\
**Category:** Zeek\
**Created:** [September 28, 2023, 4:15am UTC](https://community.zeek.org/t/about-selectively-dumping-traffic-packets-from-specific-connections-during-live-analysis/7156 "2023-09-28T04:15:17Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![mchen](https://avatars.discourse-cdn.com/v4/letter/m/bcef8e/32.png) [@mchen](https://community.zeek.org/u/mchen)\
**Post date:** [September 28, 2023, 4:15am UTC](https://community.zeek.org/t/about-selectively-dumping-traffic-packets-from-specific-connections-during-live-analysis/7156/1 "2023-09-28T04:15:17Z")

</div>

Hello,

I wonder if Zeek has the capability to selectively dump packets to pcaps that are associated with specific TCP/UDP connections during a live analysis.

I’m aware that Zeek offers the `-w` option to dump packets being analyzed to pcap. However, we are not interested in dumping all packets, but only those from certain connections.

Here are some related discussions I found:

- [Is it possible to extract the pcap from connection? · Issue #2073 · zeek/zeek · GitHub](https://github.com/zeek/zeek/issues/2073)
- [dump\_packet and dump\_current\_packet ignores file name](https://community.zeek.org/t/dump-packet-and-dump-current-packet-ignores-file-name/5294)
- [Dump all analyzed traffic to pcap files · Issue #1486 · zeek/zeek · GitHub](https://github.com/zeek/zeek/issues/1486)
- [Extracting packets from a particular connection](https://community.zeek.org/t/extracting-packets-from-a-particular-connection/5678)

From what I can gather, there seem to be two possible solutions:

1. Zeek provides the [dump\_packet](https://docs.zeek.org/en/master/scripts/base/bif/zeek.bif.zeek.html#id-dump_packet) functions. My assumption is that if I can extract the [pcap\_packet](https://github.com/zeek/zeek/blob/master/scripts/base/init-bare.zeek#L1079-L1086) type from a `conn` under a Zeek script, I can then dump all packets associated with that connection by calling this function.
2. The second option involves the [set\_record\_packets](https://docs.zeek.org/en/master/scripts/base/bif/zeek.bif.zeek.html#id-set_record_packets) function, also mentioned in this [post](https://community.zeek.org/t/extracting-packets-from-a-particular-connection/5678). It states:

> Controls whether packet contents belonging to a connection should be recorded (when `-w` option is provided on the command line).

Thus, as I understand it, `set_record_packets` controls whether packets are dumped or not in conjunction with the `-w` option. If it’s set to false, Zeek won’t dump packets even with the `-w` option. Only if it’s set to true will Zeek dump the corresponding packets.

And since the function takes `cid: conn_id` as an argument, if I provide a specific conn id, Zeek will dump all packets of that connection when the `-w` option is used.

I also have a third question related to the lifespan of a packet’s raw data. According to the [Packet.h](https://github.com/zeek/zeek/blob/master/src/iosource/Packet.h) source code, the raw data of a packet is stored in the `data` field of the Packet class:

```c++
	// These are passed in through the constructor.
    // ...
	const u_char* data = nullptr; /// Packet data.

```

However, when Zeek is about to process the next packet, it [initializes](https://github.com/zeek/zeek/blob/master/src/iosource/Packet.cc) the Packet instance:

```c++
void Packet::Init(int arg_link_type, pkt_timeval* arg_ts, uint32_t arg_caplen, uint32_t arg_len,
                  const u_char* arg_data, bool arg_copy, std::string arg_tag)
	{
	if ( data && copy )
		delete[] data;

	...

```

During this initialization, it seems to first delete the raw data of the previous packet. Therefore, it appears to me that the raw data of a packet is freed when Zeek is about to process the next packet, which would make the time window for dumping a packet from a connection quite short.

I’m not certain if my understanding is accurate, or if Zeek retains the raw data of packets for a particular connection until the entire connection has been processed, for example only when the `connection_state_remove` event had been triggered.

Thank you for your time and assistance.