Hi, I’m trying to understand how connections are formed by Bro before reporting them to conn.log - in particular, the following questions: Is it safe to assume that any given packet will be assigned to at most one connection, and thus to at most one row in conn.log? Why is it that some rows i…

Hello, let me try to give a few quick answers to your question. 1. Is it safe to assume that any given packet will be assigned to at most one connection, and thus to at most one row in conn.log? No - there is a special case for tunnels, where a connection can be the parent of another connecti…

Thanks Johanna! This helps a lot.

Definition of a connection in conn.log

Zeek

Topic		Replies	Views
Connections in conn.log Zeek	4	529	May 6, 2022
Bro connections v. NetFlow Zeek	11	290	May 6, 2022
TimeStamp of Bro output Zeek	5	112	May 6, 2022
List of connections Zeek	1	112	May 6, 2022
Connection lasts huge time Zeek	2	84	May 6, 2022

Definition of a connection in conn.log

Related topics