# Connection/flow not detected in new\_connection but in connection\_state\_remove **URL:** \ **Category:** Zeek\ **Tags:** scripting, dnp3, events\ **Created:** [March 18, 2023, 5:58am UTC](https://community.zeek.org/t/connection-flow-not-detected-in-new-connection-but-in-connection-state-remove/6938 "2023-03-18T05:58:59Z")\ **Posts on this page:** 4\ **Page:** 2
**Author:** ![awelzel](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/awelzel/32/609_2.png) [@awelzel](https://community.zeek.org/u/awelzel)\ **Post date:** [March 27, 2023, 4:28pm UTC](https://community.zeek.org/t/connection-flow-not-detected-in-new-connection-but-in-connection-state-remove/6938/21 "2023-03-27T16:28:33Z")
@biswa - one more follow up, you may want to consider or experiment running with `redef io_poll_interval_default = 1`. In `zeek -r` mode, broker communication is processed every 100 packets after a `continue_processing()` call. You may see more “interactive” communication behavior by lowering the poll\_interval, at the cost of more polling system calls. You’ll obviously experiment with a suitable setting in your environment, but wanted to point this out as I’ve been stumbling over this lately, too. ---
**Author:** ![Christian](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/christian/32/593_2.png) [@Christian](https://community.zeek.org/u/Christian)\ **Post date:** [April 13, 2023, 2:33am UTC](https://community.zeek.org/t/connection-flow-not-detected-in-new-connection-but-in-connection-state-remove/6938/22 "2023-04-13T02:33:32Z")
@biswa, could you say a bit more about what your Python endpoint actually does with the received events? Is it a plain “sink” for the subscribed events and you’re using Python mainly for convenience? Or are you also sending events back into Zeek? The discussion in this thread is very valuable (as you can tell, you might be among the first people to combine pcap processing with a Broker-peered Python script) but I’m wondering whether the overall model is going to work for you even once we overcome the startup issues. Best, Christian ---
**Author:** ![biswa](https://avatars.discourse-cdn.com/v4/letter/b/58956e/32.png) [@biswa](https://community.zeek.org/u/biswa)\ **Post date:** [April 13, 2023, 2:50am UTC](https://community.zeek.org/t/connection-flow-not-detected-in-new-connection-but-in-connection-state-remove/6938/23 "2023-04-13T02:50:53Z")
Hi @Christian I am using python broker both as subscriber and publisher. This broker daemon is not just for sinking, but the goal is to do few computationally intensive analysis and creating offline databases for further query, in the python broker with the information I receive from zeek and generate new events and send back to zeek to dump in it’s log file. However I am using pcap just because right now I don’t have live setup with me. That’s just coincidence you can say, but the positive side is that pcap testing exposed the bug. Let me know if you need any other clarification. Regards, Biswa ---
**Author:** ![Christian](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/christian/32/593_2.png) [@Christian](https://community.zeek.org/u/Christian)\ **Post date:** [April 14, 2023, 12:36am UTC](https://community.zeek.org/t/connection-flow-not-detected-in-new-connection-but-in-connection-state-remove/6938/24 "2023-04-14T00:36:10Z")
Thanks Subhajit — that all makes sense. If you want a quick & dirty replay setup to work around the bug, you could do something like ```plaintext # ip link add dummy0 type dummy # ifconfig dummy0 up ``` Then run zeek on `dummy0`, and tcpreplay your pcap onto that interface. This assumes Linux and is a bit of a hack, but also has advantages until you run “properly” on live traffic — you get to control when traffic flows, and Zeek naturally keeps running once you’ve processed the pcap. Like Arne said, kudos for your use-case. 🙂 If your Python endpoint does something generally useful, consider sharing it! Best, Christian [Previous page](https://community.zeek.org/t/connection-flow-not-detected-in-new-connection-but-in-connection-state-remove/6938.md?page=1)