# conn.log history has letter 'Q'?

**URL:** <https://community.zeek.org/t/conn-log-history-has-letter-q/3791>\
**Category:** Zeek\
**Created:** [August 25, 2015, 9:57am UTC](https://community.zeek.org/t/conn-log-history-has-letter-q/3791 "2015-08-25T09:57:47Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![user13](https://avatars.discourse-cdn.com/v4/letter/u/a88e57/32.png) [@user13](https://community.zeek.org/u/user13)\
**Post date:** [August 25, 2015, 9:57am UTC](https://community.zeek.org/t/conn-log-history-has-letter-q/3791/1 "2015-08-25T09:57:47Z")

</div>

> > I inconsistent packet (e.g. SYN+RST bits both set)

> I don’t actually know what ‘I’ stands for, but it’s for fin/rst packets, not syn/rst (although that would also be viable as long as fin is also set)

I got ‘I’ from bro document  
[https://www.bro.org/sphinx/scripts/base/protocols/conn/main.bro.html](https://www.bro.org/sphinx/scripts/base/protocols/conn/main.bro.html)

> > L a fin/rst

> I don’t believe that ‘L’ is a valid flag for the history field. Where did you find this?

Sorry I got mix up with capital ‘I’ and lower case ‘L’

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:43pm UTC](https://community.zeek.org/t/conn-log-history-has-letter-q/3791/2 "2022-05-06T15:43:00Z")

</div>