# Differences between conn.log and known\_services.log **URL:** \ **Category:** Zeek\ **Created:** [January 7, 2015, 3:17pm UTC](https://community.zeek.org/t/differences-between-conn-log-and-known-services-log/3416 "2015-01-07T15:17:23Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Vito\_Logrillo](https://avatars.discourse-cdn.com/v4/letter/v/e9bcb4/32.png) [@Vito\_Logrillo](https://community.zeek.org/u/Vito_Logrillo)\ **Post date:** [January 7, 2015, 3:17pm UTC](https://community.zeek.org/t/differences-between-conn-log-and-known-services-log/3416/1 "2015-01-07T15:17:23Z")
Hi, conn.log and known\_services.log have a field named "service": sometimes this filed is empty in conn.log but in known\_services.log is not...Why? This field should be processed in the same way by the two logs...or not? Thanks, Vito ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [January 7, 2015, 5:41pm UTC](https://community.zeek.org/t/differences-between-conn-log-and-known-services-log/3416/2 "2015-01-07T17:41:10Z")
It’s due to what is actually being logged in both of those logs. conn.log has information per-connection so you can imagine that someone might connect to a host and not actually speak the protocol that the server speaks and we don’t detect any protocol. known\_services.log is generally trying to figure out what protocol a host-port pair speaks and logs that. If no protocol is detected, we try to delay logging the fact that the port is held open in the hopes that a better connection will happen later. Make sense?   .Seth ---
**Author:** ![Vito\_Logrillo](https://avatars.discourse-cdn.com/v4/letter/v/e9bcb4/32.png) [@Vito\_Logrillo](https://community.zeek.org/u/Vito_Logrillo)\ **Post date:** [January 8, 2015, 9:45am UTC](https://community.zeek.org/t/differences-between-conn-log-and-known-services-log/3416/3 "2015-01-08T09:45:43Z")
Hi Seth, thanks for your reply. Is it correct to say that the difference between conn.log and known\_services.log is that conn.log is based on a real-time analysis and and known\_services.log is based on a delayed analysis?is it right or not? Another question: if known\_services identifies a service on a addr/port, that information is later used by conn.log or not? Thanks Vito ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [January 8, 2015, 3:03pm UTC](https://community.zeek.org/t/differences-between-conn-log-and-known-services-log/3416/4 "2015-01-08T15:03:05Z")
> Is it correct to say that the difference > between conn.log and known\_services.log is that conn.log is based on a > real-time analysis and and known\_services.log is based on a delayed > analysis?is it right or not? Technically that’s correct but I would say that it’s more accurate to say that the two logs are logging different things. conn.log is logging attribute of connections, and known\_services.log is logging aspects of host/port pairs. > Another question: if known\_services identifies a service on a > addr/port, that information is later used by conn.log or not? No, that wouldn’t make sense to do that. The service field in conn.log is solely showing you what analyzer(s) Bro used successfully to analyze the traffic on that particular connection.   .Seth ---
**Author:** ![Vito\_Logrillo](https://avatars.discourse-cdn.com/v4/letter/v/e9bcb4/32.png) [@Vito\_Logrillo](https://community.zeek.org/u/Vito_Logrillo)\ **Post date:** [January 8, 2015, 3:34pm UTC](https://community.zeek.org/t/differences-between-conn-log-and-known-services-log/3416/5 "2015-01-08T15:34:06Z")
Hi Seth, thanks for your reply, but i have some doubts about: i'll try to explain me better. Sometimes in conn.log i have an output like this: ts uid id.orig\_h id.orig\_p id.resp\_h id.resp\_p proto    service ....... xxx CYePUY1fgIZQcJHerb 10.0.1.2 40077 10.0.5.6 67 udp - ..... and in known\_services.log something like: ts host port\_num port\_proto service xxx 10.0.5.6 67 udp DHCP (ip addrs are totally arbitrary) Why do you think that a log like below is totally wrong? ts uid id.orig\_h id.orig\_p id.resp\_h id.resp\_p proto    service ....... xxx CYePUY1fgIZQcJHerb 10.0.1.2 40077 10.0.5.6 67 udp DHCP ..... In this case, i've used an information present in known\_service.log to integrate the info present in conn.log, so the service field in conn.log is not empty. Whta's wrong with this? Regards, Vito ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:42pm UTC](https://community.zeek.org/t/differences-between-conn-log-and-known-services-log/3416/6 "2022-05-06T15:42:20Z")