# "conn" field not present in connection

**URL:** <https://community.zeek.org/t/conn-field-not-present-in-connection/4875>\
**Category:** Zeek\
**Created:** [June 1, 2017, 10:16pm UTC](https://community.zeek.org/t/conn-field-not-present-in-connection/4875 "2017-06-01T22:16:59Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ren\_Wenyu](https://avatars.discourse-cdn.com/v4/letter/r/977dab/32.png) [@Ren\_Wenyu](https://community.zeek.org/u/Ren_Wenyu)\
**Post date:** [June 1, 2017, 10:16pm UTC](https://community.zeek.org/t/conn-field-not-present-in-connection/4875/1 "2017-06-01T22:16:59Z")

</div>

Hi Everyone,

I have a problem using the "conn" field in the connection record. The reference states that "conn" should exist if "base/protocols/conn/main.bro" is loaded. I have it loaded and the "conn.log" is generated. However, the "conn" field is not there. I got the connection record from the new\_packet event. Anyone have any idea? Thanks a lot.

Best,  
Wenyu

Wenyu Ren  
Ph.D. Candidate  
Department of Computer Science  
University of Illinois at Urbana-Champaign

---

<div class="post-metadata">

**Author:** ![Daniel\_Thayer](https://avatars.discourse-cdn.com/v4/letter/d/8dc957/32.png) [@Daniel\_Thayer](https://community.zeek.org/u/Daniel_Thayer)\
**Post date:** [June 2, 2017, 12:40am UTC](https://community.zeek.org/t/conn-field-not-present-in-connection/4875/2 "2017-06-02T00:40:36Z")

</div>

The documentation states that the "conn" field exists if  
base/protocols/conn/main.bro is loaded. Since the "conn" field has  
the "&optional" attribute, it is not required to have a value.

At the time that the new\_packet event is handled, not all of the  
necessary information has been gathered, so the "conn" field  
doesn't have a value yet. If you try checking in a subsequent event, such as connection\_state\_remove, then you should be able to see a value  
assigned to the "conn" field (and if you look at the base/protocols/conn/main.bro script, you can see where it assigns a value to the  
conn field).

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:45pm UTC](https://community.zeek.org/t/conn-field-not-present-in-connection/4875/3 "2022-05-06T15:45:00Z")

</div>

Closed on May 6, 2022, 3:45pm UTC