# connection states **URL:** \ **Category:** Zeek\ **Created:** [July 21, 2013, 6:11am UTC](https://community.zeek.org/t/connection-states/2735 "2013-07-21T06:11:25Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![Laleh\_Arshadi](https://avatars.discourse-cdn.com/v4/letter/l/6f9a4e/32.png) [@Laleh\_Arshadi](https://community.zeek.org/u/Laleh_Arshadi)\ **Post date:** [July 21, 2013, 6:11am UTC](https://community.zeek.org/t/connection-states/2735/1 "2013-07-21T06:11:25Z")
Dear all, Seems that Bro classifies connections into a number of states in its “connection summaries” log files. States such SF, REJ, etc. upon which it then classifies the connection into one of the three states “good”, "bad’ or “unkown”. I was wondering if one could give me a direct pointer to a reference in which these states are discussed thoroughly. Regards L. Arshadi ---
**Author:** ![Ron\_Jenkins](https://avatars.discourse-cdn.com/v4/letter/r/ba8739/32.png) [@Ron\_Jenkins](https://community.zeek.org/u/Ron_Jenkins)\ **Post date:** [July 21, 2013, 9:36am UTC](https://community.zeek.org/t/connection-states/2735/2 "2013-07-21T09:36:30Z")
I too would be interested in knowing. Thanks Ron Jenkins (SnortCP,VCP 3 / 4,MCNE,MCPS,MCNPS,CCNA) RMJ Consulting, LLC. “Bringing Companies and Solutions Together” Owner / Senior Architect Physical Address 11715 Bricksome Ave STE B-7 Baton Rouge, LA 70816 Mail Address 7575 Jefferson Hwy #103 Baton Rouge, LA 70806 Toll. 855-448-5214 Direct. 225-448-5214 Fax. 225-448-5324 Cell. 225-931-1632 Email. [rjenkins@rmjconsulting.net](mailto:rjenkins@rmjconsulting.net) Web. [http://www.rmjconsulting.net](http://www.rmjconsulting.net)[http://www.rmjconsulting.net/](http://www.rmjconsulting.net/) [http://www.linkedin.com/in/ronmjenkins](http://www.linkedin.com/in/ronmjenkins) ---
**Author:** ![Ron\_Jenkins](https://avatars.discourse-cdn.com/v4/letter/r/ba8739/32.png) [@Ron\_Jenkins](https://community.zeek.org/u/Ron_Jenkins)\ **Post date:** [July 21, 2013, 10:30am UTC](https://community.zeek.org/t/connection-states/2735/3 "2013-07-21T10:30:29Z")
FYI I found the below link. Thanks [http://www.icir.org/robin/rwth/bro-tour.pdf](http://www.icir.org/robin/rwth/bro-tour.pdf) Ron Jenkins (SnortCP, VCP (3/4), MCNE, CNE6, MCP,CCNA) **RMJ Consulting, LLC.** “_Bringing Companies and Solutions Together_” Makers of **Active Response System(ARS)** & **Log Siphon** Owner / Senior Architect **Physical Address** 11715 Bricksome Ave STE B-7 Baton Rouge, LA 70816 **Mail Address** 7575 Jefferson Hwy #103 Baton Rouge, LA 70806 **Toll:** 855-448-5214 **Direct**. 225-448-5214 **Fax.** 225-448-5324 **Cell.** 225-931-1632 **Email.** [rjenkins@rmjconsulting.net](mailto:rjenkins@rmjconsulting.net) **Web.** [http://www.rmjconsulting.net](http://www.rmjconsulting.net/) **ARS.** [http://www.rmjars.com](http://www.rmjars.com/) **Log Siphon**. [http://www.logsiphon.com](http://www.logsiphon.com/) **Linkedin.** [http://www.linkedin.com/profile/view?id=28564151&trk=tab\_pro](http://www.linkedin.com/profile/view?id=28564151&trk=tab_pro) ---
**Author:** ![Vlad\_Grigorescu2](https://avatars.discourse-cdn.com/v4/letter/v/c4cdca/32.png) [@Vlad\_Grigorescu2](https://community.zeek.org/u/Vlad_Grigorescu2)\ **Post date:** [July 21, 2013, 1:11pm UTC](https://community.zeek.org/t/connection-states/2735/4 "2013-07-21T13:11:44Z")
Wow, a 17 line sig for a 2 line e-mail. That might be a new record.   --Vlad ---
**Author:** ![Laleh\_Arshadi](https://avatars.discourse-cdn.com/v4/letter/l/6f9a4e/32.png) [@Laleh\_Arshadi](https://community.zeek.org/u/Laleh_Arshadi)\ **Post date:** [July 21, 2013, 5:18pm UTC](https://community.zeek.org/t/connection-states/2735/5 "2013-07-21T17:18:08Z")
Hi Ron Thanks for the link but unfortunately it does not contain all the information I am looking for. L. Arshadi FYI I found the below link. Thanks [http://www.icir.org/robin/rwth/bro-tour.pdf](http://www.icir.org/robin/rwth/bro-tour.pdf) Ron Jenkins (SnortCP, VCP (3/4), MCNE, CNE6, MCP,CCNA) Dear all, Seems that Bro classifies connections into a number of states in its “connection summaries” log files. States such SF, REJ, etc. upon which it then classifies the connection into one of the three states “good”, "bad’ or “unkown”. I was wondering if one could give me a direct pointer to a reference in which these states are discussed thoroughly. Regards L. Arshadi ---
**Author:** ![Alex\_Waher](https://avatars.discourse-cdn.com/v4/letter/a/8e7dd6/32.png) [@Alex\_Waher](https://community.zeek.org/u/Alex_Waher)\ **Post date:** [July 21, 2013, 5:35pm UTC](https://community.zeek.org/t/connection-states/2735/6 "2013-07-21T17:35:17Z")
[http://www.bro-project.org/sphinx-git/scripts/base/protocols/conn/main.html](http://www.bro-project.org/sphinx-git/scripts/base/protocols/conn/main.html) ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [July 22, 2013, 1:53pm UTC](https://community.zeek.org/t/connection-states/2735/7 "2013-07-22T13:53:40Z")
I suspect the link from Alex answered your question, but to go a little further than the rote documentation I'd like to point out that what that field really represents is how Bro chose to perceive the connection. Since Bro is a third party passive observer it can't always perfectly understand the conversation for various reasons like packet loss, missing packets due to asynchronous routing, or peculiar host semantics that Bro doesn't understand. Check out the history field too if you want a little more information about what Bro actually saw on the wire. It's documented on the same page:   [http://www.bro.org/sphinx-git/scripts/base/protocols/conn/main.html](http://www.bro.org/sphinx-git/scripts/base/protocols/conn/main.html)   .Seth ---
**Author:** ![Laleh\_Arshadi](https://avatars.discourse-cdn.com/v4/letter/l/6f9a4e/32.png) [@Laleh\_Arshadi](https://community.zeek.org/u/Laleh_Arshadi)\ **Post date:** [July 22, 2013, 3:54pm UTC](https://community.zeek.org/t/connection-states/2735/8 "2013-07-22T15:54:18Z")
Hi Thank you both Alex and Seth for the link and the explanation. I got the taste of the connection states, now I am looking for the policies upon which Bro decides that a connection is “good”, "bad’ or “unkown”. Is anything stated in the documents in this regard? Regards Laleh ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [July 22, 2013, 4:23pm UTC](https://community.zeek.org/t/connection-states/2735/9 "2013-07-22T16:23:03Z")
Hm, your question is a little broad. 🙂 .Seth ---
**Author:** ![Laleh\_Arshadi](https://avatars.discourse-cdn.com/v4/letter/l/6f9a4e/32.png) [@Laleh\_Arshadi](https://community.zeek.org/u/Laleh_Arshadi)\ **Post date:** [July 22, 2013, 6:11pm UTC](https://community.zeek.org/t/connection-states/2735/10 "2013-07-22T18:11:23Z")
OK… to be more precise, how can I decide which connection is suspicious to be a TCP scanning attempt? ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [July 22, 2013, 6:30pm UTC](https://community.zeek.org/t/connection-states/2735/11 "2013-07-22T18:30:02Z")
That's mostly going to depend on what you consider a TCP scan attempt. This is such a hard problem and could be slightly different in everyone's context. Anyway, I would recommend taking a look at the scan.bro that is in our master repository. It's a new script that is coming out with the upcoming 2.2 release and it works pretty well, if you read and understand that script it should answer your question though.   .Seth ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:41pm UTC](https://community.zeek.org/t/connection-states/2735/12 "2022-05-06T15:41:05Z")