# ContentGap problem in offline traces

**URL:** <https://community.zeek.org/t/contentgap-problem-in-offline-traces/1155>\
**Category:** Zeek\
**Created:** [March 20, 2007, 11:46pm UTC](https://community.zeek.org/t/contentgap-problem-in-offline-traces/1155 "2007-03-20T23:46:35Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Eric\_Thomas](https://avatars.discourse-cdn.com/v4/letter/e/96bed5/32.png) [@Eric\_Thomas](https://community.zeek.org/u/Eric_Thomas)\
**Post date:** [March 20, 2007, 11:46pm UTC](https://community.zeek.org/t/contentgap-problem-in-offline-traces/1155/1 "2007-03-20T23:46:35Z")

</div>

Hi,

I have an HTTP trace where I downloaded a 20 meg executable (no encoding).  
The trace was created by tcpdump, not bro. It was suggested in the archives  
that if one gets a lot of ContentGap errors when processing a trace off-line  
it is likely because there are missing packets in the trace. I'm sure my  
trace has all of the packets because if I run tcpflow on the trace and  
remove all of the HTTP headers from the larger of the two resulting files, I  
get a file that is the same size as the executable I downloaded.

When I process the trace offline with bro (I have a custom policy that  
writes the HTTP data out using the http\_entity\_data event) I get a lot of  
ContentGap errors. The size of the written file is smaller than the size of  
the executable. When I add up all of the missing bytes reported by the many  
ContentGap notices, the sum is exactly the difference between the size (in  
bytes) of the executable and the size of the written file. Therefore, I  
assume that Bro is not passing the "missing" data to the http\_entity\_data  
handler.

When all of the packets are in the trace and my filter (according to  
print-filter) is "tcp or icmp or udp", what else is a common cause of the  
ContentGap notice? Is there some tweak that I need to make to account for  
larger gaps/windows?

Eric Thomas  
edthoma [you know what to do] [sandia.gov](http://sandia.gov)

---

<div class="post-metadata">

**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\
**Post date:** [March 21, 2007, 12:03am UTC](https://community.zeek.org/t/contentgap-problem-in-offline-traces/1155/2 "2007-03-21T00:03:08Z")

</div>

Any chance you could send us the trace to have a look at?

&nbsp;&nbsp;&nbsp;&nbsp;Vern

---

<div class="post-metadata">

**Author:** ![Eric\_Thomas](https://avatars.discourse-cdn.com/v4/letter/e/96bed5/32.png) [@Eric\_Thomas](https://community.zeek.org/u/Eric_Thomas)\
**Post date:** [March 21, 2007, 12:48am UTC](https://community.zeek.org/t/contentgap-problem-in-offline-traces/1155/3 "2007-03-21T00:48:32Z")

</div>

I'll sync up with you off-line. Thanks!

Eric

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:38pm UTC](https://community.zeek.org/t/contentgap-problem-in-offline-traces/1155/4 "2022-05-06T15:38:13Z")

</div>