# Connection summaries question

**URL:** <https://community.zeek.org/t/connection-summaries-question/613>\
**Category:** Zeek\
**Created:** [October 14, 2004, 1:33pm UTC](https://community.zeek.org/t/connection-summaries-question/613 "2004-10-14T13:33:08Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Christian\_Kreibich3](https://avatars.discourse-cdn.com/v4/letter/c/4af34b/32.png) [@Christian\_Kreibich3](https://community.zeek.org/u/Christian_Kreibich3)\
**Post date:** [October 14, 2004, 1:33pm UTC](https://community.zeek.org/t/connection-summaries-question/613/1 "2004-10-14T13:33:08Z")

</div>

Hi,

are the following observations correct:

- When Bro encounters a flow mid-stream and that flow gets shut down  
normally in the end, I see "SF" in connection summaries.

- Also, it appears that when one port is well-known and the other is  
ephemeral, Bro assumes that the connection was established from the  
ephemeral to the well-known one.

This is based on the following tiny trace:  
[http://www.cl.cam.ac.uk/~cpk25/outback/http-single-midstream.trace](http://www.cl.cam.ac.uk/~cpk25/outback/http-single-midstream.trace)

I'm asking because I'm selecting flows from a trace based on this output  
and the semantics matter. Intuitively I would have assumed that SF is  
only printed for flows seen in their entirety. OTH, however, seems to  
stand for just mid-stream data with neither handshake nor teardown seen,  
and there doesn't seem to be a symbol for flows seen from mid-stream to  
the end?

Thanks,  
Christian.

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:37pm UTC](https://community.zeek.org/t/connection-summaries-question/613/2 "2022-05-06T15:37:13Z")

</div>