# Connection/flow not detected in new\_connection but in connection\_state\_remove

**URL:** <https://community.zeek.org/t/connection-flow-not-detected-in-new-connection-but-in-connection-state-remove/6938>\
**Category:** Zeek\
**Tags:** scripting, dnp3, events\
**Created:** [March 18, 2023, 5:58am UTC](https://community.zeek.org/t/connection-flow-not-detected-in-new-connection-but-in-connection-state-remove/6938 "2023-03-18T05:58:59Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![biswa](https://avatars.discourse-cdn.com/v4/letter/b/58956e/32.png) [@biswa](https://community.zeek.org/u/biswa)\
**Post date:** [March 18, 2023, 5:58am UTC](https://community.zeek.org/t/connection-flow-not-detected-in-new-connection-but-in-connection-state-remove/6938/1 "2023-03-18T05:58:59Z")

</div>

I was trying to print new connection detected from the below pcap file

[https://github.com/cisagov/icsnpp-dnp3/blob/main/tests/traces/dnp3\_example.pcap](https://github.com/cisagov/icsnpp-dnp3/blob/main/tests/traces/dnp3_example.pcap)

The connection/flow from src port 20000 to dst port 20000 is not detected in new\_connection (total 10 connections detected) but connection\_state\_remove showing that connection/flow (total 11 connections). Why so?

Regards,  
Subhajit

---

_[View the full topic](https://community.zeek.org/t/connection-flow-not-detected-in-new-connection-but-in-connection-state-remove/6938)._