# Analysing a pcap using zeek

**URL:** <https://community.zeek.org/t/analysing-a-pcap-using-zeek/6643>\
**Category:** Zeek\
**Tags:** pcap\
**Created:** [August 5, 2022, 11:55am UTC](https://community.zeek.org/t/analysing-a-pcap-using-zeek/6643 "2022-08-05T11:55:44Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![prajwalShavi](https://avatars.discourse-cdn.com/v4/letter/p/ecb155/32.png) [@prajwalShavi](https://community.zeek.org/u/prajwalShavi)\
**Post date:** [August 5, 2022, 11:55am UTC](https://community.zeek.org/t/analysing-a-pcap-using-zeek/6643/1 "2022-08-05T11:55:44Z")

</div>

Hello!

I am trying to analyze a pcap file in which I want to retrieve all the source IP and destination IP and also want to add two fields which says that the source IP and destination IP belongs to which class.

I’m able to create a new log file named “origs” that has “ts”, “id.orig\_h”,“id.resp\_h”. How can I add new fields to the same log file.

Below is the pseudo-code.

```auto
event zeek_init()
{
    # Add a new filter to the Conn::LOG stream that logs only
    local filter: Log::Filter = [$name="orig-only", $path="origs",
                                 $include=set("ts", "id.orig_h","id.resp_h")];
    
    Log::add_filter(Conn::LOG, filter);
}

```

Please help me…

---

<div class="post-metadata">

**Author:** ![JustinAzoff](https://avatars.discourse-cdn.com/v4/letter/j/13edae/32.png) [@JustinAzoff](https://community.zeek.org/u/JustinAzoff)\
**Post date:** [August 13, 2022, 10:53pm UTC](https://community.zeek.org/t/analysing-a-pcap-using-zeek/6643/2 "2022-08-13T22:53:33Z")

</div>

HI,

You can add fields to a log by redef’ing the log record type. See here: [Logging Framework — Book of Zeek (git/master)](https://docs.zeek.org/en/master/frameworks/logging.html#add-fields-to-a-log)

That example is for extending the conn log and is exactly what you are looking to do.