# about **URL:** \ **Category:** Zeek\ **Created:** [January 4, 2003, 7:18am UTC](https://community.zeek.org/t/about/334 "2003-01-04T07:18:04Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\ **Post date:** [January 4, 2003, 7:18am UTC](https://community.zeek.org/t/about/334/1 "2003-01-04T07:18:04Z")
> However, I am still can't understand why all the status of connection not > from/to my host is "S0", which means "no answer", while my host's > connections were all right. That's very strange, unless in your setup Bro is massively dropping packets. So the next thing to do is use Bro's "-w tracefile" option to record the packets it's analyzing. Next time you find an S0 FTP session which you're sure was successful, extract the corresponding packets from the trace. If there are just initial SYNs and nothing else, then Bro was correct, and you were mistaken regarding that particular session being successful. If on the other hand there's an initial SYN, no SYN-ACK, but a bunch of subsequent packets related to the connection, then Bro is dropping packets. I can help with this analysis (send me the trace off-line) if needed.     Vern ---
**Author:** ![Ashley\_Thomas](https://avatars.discourse-cdn.com/v4/letter/a/e36b37/32.png) [@Ashley\_Thomas](https://community.zeek.org/u/Ashley_Thomas)\ **Post date:** [January 4, 2003, 7:25am UTC](https://community.zeek.org/t/about/334/2 "2003-01-04T07:25:00Z")
You could also just watch the variable 'drop' returned by pcap\_stats( ) to see if there are drops. pcap\_stats is called by bro in the HeartBeat function, i guess. This is \*assuming\* pcap is giving the drops value correctly. I remember, there was bug on some OSs. -ashley Vern Paxson wrote: ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:36pm UTC](https://community.zeek.org/t/about/334/3 "2022-05-06T15:36:41Z")