# conn.bro **URL:** \ **Category:** Development\ **Tags:** development\ **Created:** [May 2, 2011, 10:43pm UTC](https://community.zeek.org/t/conn-bro/1872 "2011-05-02T22:43:38Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [May 2, 2011, 10:43pm UTC](https://community.zeek.org/t/conn-bro/1872/1 "2011-05-02T22:43:38Z")
- ts: I'd prefer to keep this the timestamp of the first packet,   that's more well defined. - Did we decide whether we want to add the raw byte volume via   Gregor's patch? I'd say so. I'll see that that gets merged in. - I'd say let's include history by default, but not addl. - "logging" isn't used. - Rename "connection$log" to "connection$conn" for consistency? Robin ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [May 3, 2011, 6:47pm UTC](https://community.zeek.org/t/conn-bro/1872/2 "2011-05-03T18:47:56Z")
> - ts: I'd prefer to keep this the timestamp of the first packet, > that's more well defined. Isn't that what c$start\_time is? > - Did we decide whether we want to add the raw byte volume via > Gregor's patch? I'd say so. I'll see that that gets merged in. This isn't merged yet then? If not, I'll add it once it's merged. > - I'd say let's include history by default, but not addl. Done. > - "logging" isn't used. Removed. I think I want to handle that more generically since the splitting and filtering is the same for all log files now. > - Rename "connection$log" to "connection$conn" for consistency? Agreed and done. This script was much faster to update than the dns script. 🙂   .Seth ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [May 3, 2011, 7:37pm UTC](https://community.zeek.org/t/conn-bro/1872/3 "2011-05-03T19:37:23Z")
> \> - ts: I'd prefer to keep this the timestamp of the first packet, > \> that's more well defined. > > Isn't that what c$start\_time is? Sorry, I wasn't clear: I prefer to have c$start\_time \*logged\*. > This isn't merged yet then? If not, I'll add it once it's merged. Correct, working on it. Thanks! Robin ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [May 3, 2011, 7:57pm UTC](https://community.zeek.org/t/conn-bro/1872/4 "2011-05-03T19:57:19Z")
It is. Do you want the field named "start\_time"? I was just trying to keep consistency among those first several fields for all of the logs with the assumption that in each case the $ts field is the earliest evident activity for whatever the logged data is (initial request for http, first packet for conn, etc).   .Seth ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [May 3, 2011, 11:20pm UTC](https://community.zeek.org/t/conn-bro/1872/5 "2011-05-03T23:20:16Z")
Ok, I see that now, but then the comment is wrong, isn't it?           ## This is the time at which the connection was "fully established";           ts: time &log; Robin ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [May 4, 2011, 3:52am UTC](https://community.zeek.org/t/conn-bro/1872/6 "2011-05-04T03:52:06Z")
Oops. Fixed.   .Seth ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:39pm UTC](https://community.zeek.org/t/conn-bro/1872/7 "2022-05-06T15:39:33Z")