Adding flow and packet stats on conn log

I’m reading a bunch of papers on interesting features for machine learning applied on network traffic. For example CSE-CIC (

My question is: is it possible to add this type of statistic on conn.log?

  • average packet size
  • minimum packet size
  • maximum packet size
  • total time between two packets
  • mean time between two packets etc.
  • etc.

Reading in the documentation I saw this events but, as state by the documentation itself, it will lead to very poor performance.

The other code I think it could be relevant is the TCP analyzer:

I’ve never contributed to Zeek before and I don’t know the codebase at all, so do you think Zeek would be capable of generating this type of stats? Is the right place to implement those features? Are there issues I am overlooking?

if you’re working with pcaps, you could possibly achieve this with a script.
there’s a tcp_packet event that provides the connection as well as the length of the packet.
for times, the network_time built in function should help you get started.

i would be careful trying this with live traffic, you might wind up having an unacceptable performance impact on your workers as that’s a pretty frequent event.