# \[Bro-Commits\] \[git/trace-summary\] fastpath: Teach trace-summary to parse Bro's new conn.log format (closes #520) (975204a)

**URL:** <https://community.zeek.org/t/bro-commits-git-trace-summary-fastpath-teach-trace-summary-to-parse-bros-new-conn-log-format-closes-520-975204a/1948>\
**Category:** Development\
**Tags:** development\
**Created:** [July 28, 2011, 4:01pm UTC](https://community.zeek.org/t/bro-commits-git-trace-summary-fastpath-teach-trace-summary-to-parse-bros-new-conn-log-format-closes-520-975204a/1948 "2011-07-28T16:01:50Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Gregor\_Maier](https://avatars.discourse-cdn.com/v4/letter/g/94ad74/32.png) [@Gregor\_Maier](https://community.zeek.org/u/Gregor_Maier)\
**Post date:** [July 28, 2011, 4:01pm UTC](https://community.zeek.org/t/bro-commits-git-trace-summary-fastpath-teach-trace-summary-to-parse-bros-new-conn-log-format-closes-520-975204a/1948/1 "2011-07-28T16:01:50Z")

</div>

Hi,

I don't know whether ConnSizeAnalyzer's output (number of IP bytes and packets on the wire) can also be added to the new conn.log (Seth?). If so, it might make sense to give trace-summary a flag to use those counters.

cu  
Gregor

---

<div class="post-metadata">

**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\
**Post date:** [July 28, 2011, 4:58pm UTC](https://community.zeek.org/t/bro-commits-git-trace-summary-fastpath-teach-trace-summary-to-parse-bros-new-conn-log-format-closes-520-975204a/1948/2 "2011-07-28T16:58:38Z")

</div>

I still haven't done the ConnSizeAnalyzer integration where I want it yet. Does it seem unreasonable to anyone to have that enabled mostly by default? I think it's useful enough that it would be enabled nearly all the time anyway.

I want/need to integrate it into the SSH analysis and Conn analysis at the very least. If we have the ConnSizeAnalyzer enabled "by default" then I'll add the fields to the core conn scripts, otherwise it will be an extension script (I'd rather have it in the core script support).

&nbsp;&nbsp;.Seth

---

<div class="post-metadata">

**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\
**Post date:** [July 28, 2011, 6:47pm UTC](https://community.zeek.org/t/bro-commits-git-trace-summary-fastpath-teach-trace-summary-to-parse-bros-new-conn-log-format-closes-520-975204a/1948/3 "2011-07-28T18:47:15Z")

</div>

> I still haven't done the ConnSizeAnalyzer integration where I want it yet. Does it seem unreasonable to anyone to have that enabled mostly by default? I think it's useful enough that it would be enabled nearly all the time anyway.

Yeah, it strikes me as bread-&-butter info that it's sort of embarrassing  
the logs historically didn't track :-P.

&nbsp;&nbsp;&nbsp;&nbsp;Vern

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:39pm UTC](https://community.zeek.org/t/bro-commits-git-trace-summary-fastpath-teach-trace-summary-to-parse-bros-new-conn-log-format-closes-520-975204a/1948/4 "2022-05-06T15:39:42Z")

</div>