# Bro byte and packet counting in devel **URL:** \ **Category:** Development\ **Tags:** development\ **Created:** [February 25, 2011, 4:51pm UTC](https://community.zeek.org/t/bro-byte-and-packet-counting-in-devel/1822 "2011-02-25T16:51:38Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![Gregor\_Maier](https://avatars.discourse-cdn.com/v4/letter/g/94ad74/32.png) [@Gregor\_Maier](https://community.zeek.org/u/Gregor_Maier)\ **Post date:** [February 25, 2011, 4:51pm UTC](https://community.zeek.org/t/bro-byte-and-packet-counting-in-devel/1822/1 "2011-02-25T16:51:38Z")
Hi, the analyzer to count bytes and packets as seen on the wire per connection (endpoint) is now in devel. If enabled the counters are part of the connection record (actually the endpoint records) and can thus be access by any event that gets a connection as argument. To enable:   redef use\_conn\_size\_analyzer = T; To enable logging the sizes to conn.log: # Whether to add 4 more columns to conn.log with # orig\_packet orig\_ip\_bytes resp\_packets resp\_ip\_bytes # Requires use\_conn\_size\_analyzer=T # Columns are added after history but before addl redef report\_conn\_size\_analyzer = T; You might want to consider enables those if you run devel.... cu Gregor ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [March 5, 2011, 5:07am UTC](https://community.zeek.org/t/bro-byte-and-packet-counting-in-devel/1822/2 "2011-03-05T05:07:30Z")
Thanks for doing the work on this, I've been wanting this functionality built into Bro for a long time. Is there any plan for getting this integrated into master? I see that there isn't a merge request yet, are you waiting for more testing? It just came up for me because I'm rewriting the conn.bro script and I want to include that data if the analyzer is enabled as a replacement for the normal c$orig$size and c$resp$size. Thanks, .Seth ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [March 5, 2011, 5:18am UTC](https://community.zeek.org/t/bro-byte-and-packet-counting-in-devel/1822/3 "2011-03-05T05:18:52Z")
It's merged into devel and I going to give a bit of testing there before merging it into master. Robin ---
**Author:** ![Gregor\_Maier](https://avatars.discourse-cdn.com/v4/letter/g/94ad74/32.png) [@Gregor\_Maier](https://community.zeek.org/u/Gregor_Maier)\ **Post date:** [March 5, 2011, 6:28pm UTC](https://community.zeek.org/t/bro-byte-and-packet-counting-in-devel/1822/4 "2011-03-05T18:28:49Z")
> > the analyzer to count bytes and packets as seen on the wire per > > connection (endpoint) is now in devel. If enabled the counters are part > > of the connection record (actually the endpoint records) and can thus be > > access by any event that gets a connection as argument. > > Thanks for doing the work on this, I've been wanting this functionality built into Bro for a long time. Is there any plan for getting this integrated into master? I see that there isn't a merge request yet, are you waiting for more testing? see Robin's mail > It just came up for me because I'm rewriting the conn.bro script and I want to include that data if the analyzer is enabled as a replacement for the normal c$orig$size and c$resp$size. I've actually added the counters as additional columns in conn.bro (there's one flag to enable the analyzer and another one to enable logging in conn.log) You might also want to consider that osize and rsize try to count the logical number of payload bytes whereas my analyzer counts the number of IP bytes so I don't know whether replacing the osize and rsize makes sense (since it breaks behavior and given a conn.log file, it's hard to know which format it's in). OTOH, I think that people new to bro often get confused as to what osize and rsize are (e.g., that can be heavily inflated and need sanity checking). (I don't have a preference to do it one way or the other, btw) cu gregor ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [March 7, 2011, 2:54pm UTC](https://community.zeek.org/t/bro-byte-and-packet-counting-in-devel/1822/5 "2011-03-07T14:54:49Z")
> > It just came up for me because I'm rewriting the conn.bro script and I want to include that data if the analyzer is enabled as a replacement for the normal c$orig$size and c$resp$size. > > I've actually added the counters as additional columns in conn.bro > (there's one flag to enable the analyzer and another one to enable > logging in conn.log) I'm reworking a lot of the analyzer companion scripts now (including conn.bro) and changing them to use the logging framework. I may make it an option in the new conn.bro script too. It should be pretty straightforward, especially since we've been working on giving the logging framework the specific capability for doing record extension to do this sort of thing. > You might also want to consider that osize and rsize try to count the > logical number of payload bytes whereas my analyzer counts the number of > IP bytes Oh, good point. That's definitely something to think about. > OTOH, I think that people new to bro often get confused as to what osize > and rsize are (e.g., that can be heavily inflated and need sanity > checking). I was confused by that for a while. It was weird for a while since I came from netflow analysis where you can pretty reliably trust the byte counts once you put all of the related flows back together.   .Seth ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [March 7, 2011, 4:43pm UTC](https://community.zeek.org/t/bro-byte-and-packet-counting-in-devel/1822/6 "2011-03-07T16:43:17Z")
Yeah, it's actually an important distinction. I think I'd like the default to remain as it it: count TCP payload, and have an option to optionally add (but not replace with) the raw bytes. One selling point here is that the TCP values are actually something that NetFloow can not offer. Robin ---
**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\ **Post date:** [March 8, 2011, 8:30am UTC](https://community.zeek.org/t/bro-byte-and-packet-counting-in-devel/1822/7 "2011-03-08T08:30:46Z")
> You might also want to consider that osize and rsize try to count the > logical number of payload bytes whereas my analyzer counts the number of I'm confused. Are you referring to [or]{lower,upper}? I'm not recalling [or]size ...     Vern ---
**Author:** ![Gregor\_Maier](https://avatars.discourse-cdn.com/v4/letter/g/94ad74/32.png) [@Gregor\_Maier](https://community.zeek.org/u/Gregor_Maier)\ **Post date:** [March 8, 2011, 3:57pm UTC](https://community.zeek.org/t/bro-byte-and-packet-counting-in-devel/1822/8 "2011-03-08T15:57:28Z")
I'm confused. I was referring the connection size as reported in conn.log (the size that's tracked in the endpoint record of a connection). hth Gregor ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [March 8, 2011, 4:11pm UTC](https://community.zeek.org/t/bro-byte-and-packet-counting-in-devel/1822/9 "2011-03-08T16:11:15Z")
[or]size is in the endpoint record. I think you may be thinking of the large-conns.bro script that calculates an upper and lower bound for the connection size.   .Seth ---
**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\ **Post date:** [March 8, 2011, 5:13pm UTC](https://community.zeek.org/t/bro-byte-and-packet-counting-in-devel/1822/10 "2011-03-08T17:13:35Z")
> [or]size is in the endpoint record. I think you may be thinking of the > large-conns.bro script that calculates an upper and lower bound for the > connection size. Yep, exactly. I grepped around for osize/rsize and didn't find it. In fact, I'm still not finding it. So is this an informal term, or am I not looking in the right place?     Vern ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [March 8, 2011, 5:30pm UTC](https://community.zeek.org/t/bro-byte-and-packet-counting-in-devel/1822/11 "2011-03-08T17:30:00Z")
c$orig$size and c$resp$size type endpoint: record {   size: count;   state: count; }; type connection: record {   id: conn\_id;   orig: endpoint;   resp: endpoint;   start\_time: time;   duration: interval;   service: string\_set; # if empty, service hasn't been determined   addl: string;   hot: count; # how hot; 0 = don't know or not hot   history: string; };   .Seth ---
**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\ **Post date:** [March 8, 2011, 5:32pm UTC](https://community.zeek.org/t/bro-byte-and-packet-counting-in-devel/1822/12 "2011-03-08T17:32:49Z")
> c$orig$size and c$resp$size Ah, sure. I thought the thread was literally referring to "osize" and "rsize" (given their similarity to olower/oupper, etc.).     Vern ---
**Author:** ![Gregor\_Maier](https://avatars.discourse-cdn.com/v4/letter/g/94ad74/32.png) [@Gregor\_Maier](https://community.zeek.org/u/Gregor_Maier)\ **Post date:** [March 8, 2011, 5:33pm UTC](https://community.zeek.org/t/bro-byte-and-packet-counting-in-devel/1822/13 "2011-03-08T17:33:27Z")
I guess it's indeed an informal term then. I guess I've been using it so frequently in my scripts, etc. that I've assumed it's a common term. cu gregor ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:39pm UTC](https://community.zeek.org/t/bro-byte-and-packet-counting-in-devel/1822/14 "2022-05-06T15:39:28Z")