# Connections and Crossed\_Threshold-Event

**URL:** <https://community.zeek.org/t/connections-and-crossed-threshold-event/4933>\
**Category:** Zeek\
**Created:** [July 10, 2017, 12:25pm UTC](https://community.zeek.org/t/connections-and-crossed-threshold-event/4933 "2017-07-10T12:25:35Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dominique\_Krause\_Mei](https://avatars.discourse-cdn.com/v4/letter/d/b2d939/32.png) [@Dominique\_Krause\_Mei](https://community.zeek.org/u/Dominique_Krause_Mei)\
**Post date:** [July 10, 2017, 12:25pm UTC](https://community.zeek.org/t/connections-and-crossed-threshold-event/4933/1 "2017-07-10T12:25:35Z")

</div>

Hello Bro Community,

i wrote a script which is able to determine the amount of data transfered by a given connection. If the datatransfer crosses a set limit, a crossed\_threshold event is triggered. The connection which crossed the threshold is logged into a log file.

Now, if i set a limit of 150.000 Bytes for example, the log file holds connections with 75.000 or 100.000 Bytes of transfered data.  
This looks a bit confusing because the connections crossed the 150.000 Byte threshold but the log file entry states a different, lower number.

May someone please explain why this occurs and how to fix/change this behaviour/problem?

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:45pm UTC](https://community.zeek.org/t/connections-and-crossed-threshold-event/4933/2 "2022-05-06T15:45:07Z")

</div>

Closed on May 6, 2022, 3:45pm UTC