# Can not dump the first packet? **URL:** \ **Category:** Zeek\ **Created:** [January 13, 2008, 1:04pm UTC](https://community.zeek.org/t/can-not-dump-the-first-packet/1283 "2008-01-13T13:04:40Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![user27](https://avatars.discourse-cdn.com/v4/letter/u/a183cd/32.png) [@user27](https://community.zeek.org/u/user27)\ **Post date:** [January 13, 2008, 1:04pm UTC](https://community.zeek.org/t/can-not-dump-the-first-packet/1283/1 "2008-01-13T13:04:40Z")
Hello! Can I ask a question about Bro? I want to dump the packets of certain connections to a pcap file. I used the function “dump\_packets\_of\_connection” when the the event “connection\_state\_remove” happen. But I found that the first packet (always the SYN packet) of the connection was missed in the pcap file. And I tryed to dump all the packets to a file using the function “dump\_current\_packet” in the event “tcp\_packet”. I found that the second packet of a connection was dumped twice but the first packet (the SYN packet) was missed. It occured again when I print the data of the all the packets. How can I get the first packet and dump it? Thanks! Owen Ma 08.01.13 ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [January 14, 2008, 8:22pm UTC](https://community.zeek.org/t/can-not-dump-the-first-packet/1283/2 "2008-01-14T20:22:14Z")
This is due to the connection compressor. The compressor defers instantiating connection state until it sees packets from both sides, which is why it can't raise events such as tcp\_packet() immediately with the first packet (the event carries a connection parameter). Not sure what the best fix for this is (if there's any at all) but you can work around the problem by turning the compressor off via "redef use\_connection\_compressor=F". Robin ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:38pm UTC](https://community.zeek.org/t/can-not-dump-the-first-packet/1283/3 "2022-05-06T15:38:27Z")