# Connection lasts huge time **URL:** \ **Category:** Zeek\ **Created:** [July 5, 2016, 3:30pm UTC](https://community.zeek.org/t/connection-lasts-huge-time/4227 "2016-07-05T15:30:15Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Rotondo\_Simone](https://avatars.discourse-cdn.com/v4/letter/r/a5b964/32.png) [@Rotondo\_Simone](https://community.zeek.org/u/Rotondo_Simone)\ **Post date:** [July 5, 2016, 3:30pm UTC](https://community.zeek.org/t/connection-lasts-huge-time/4227/1 "2016-07-05T15:30:15Z")
Hi, in my Bro logs, I have some connections that lasts 6 hours and more. Those conns use different services: ---
**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\ **Post date:** [July 8, 2016, 5:03pm UTC](https://community.zeek.org/t/connection-lasts-huge-time/4227/2 "2016-07-08T17:03:04Z")
Hello Simone, Are you sure that these connections did not just last several hours? If you are sure - the only possible way that I can think of for these values getting messed up is libpcap (and thus probably the kernel) delivering wrong timestamps for packets. Bro just determines the duration by sybstracting the timestamp of the first packet that it saw from the timestamp of the last packet that it saw. Additionally, Bro will expire connections where it has not seen any packets, generally after a few minutes. I have seen wrong timestamps being delivered for a couple of packets before, but in those cases they were off by years, not just by hours, so I consider that unlikely. Johanna ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:43pm UTC](https://community.zeek.org/t/connection-lasts-huge-time/4227/3 "2022-05-06T15:43:49Z")