# Extracting packets from a particular connection

**URL:** <https://community.zeek.org/t/extracting-packets-from-a-particular-connection/5678>\
**Category:** Zeek\
**Created:** [April 24, 2019, 1:48pm UTC](https://community.zeek.org/t/extracting-packets-from-a-particular-connection/5678 "2019-04-24T13:48:04Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Raghunath\_Ananditha](https://avatars.discourse-cdn.com/v4/letter/r/77aa72/32.png) [@Raghunath\_Ananditha](https://community.zeek.org/u/Raghunath_Ananditha)\
**Post date:** [April 24, 2019, 1:48pm UTC](https://community.zeek.org/t/extracting-packets-from-a-particular-connection/5678/1 "2019-04-24T13:48:04Z")

</div>

Hi,

I was hoping to understand how Zeek aggregates packets by connection. Is there any documentation that summarizes the approach? Is there a way to extract all the packets that correspond to a particular connection?

Thank you,

Ananditha Raghunath - 0557

Assistant Staff

Cyber Operations and Analysis Technology

MIT Lincoln Laboratory

ananditha.raghunath@ll.mit.edu | 781-981-9035

---

<div class="post-metadata">

**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\
**Post date:** [June 20, 2019, 5:21pm UTC](https://community.zeek.org/t/extracting-packets-from-a-particular-connection/5678/2 "2019-06-20T17:21:32Z")

</div>

Hi,

a bit late, but...

> I was hoping to understand how Zeek aggregates packets by connection. Is  
> there any documentation that summarizes the approach? Is there a way to  
> extract all the packets that correspond to a particular connection?

I don't think there is much documentation sadly. Basically - Zeek  
identifies connections by 5-tuple and passes the packets on to the  
TCP/UDP/ICMP protocol parsers for a specific connection. Connections are  
timed out after a time amount that depends on the protocol, port, and  
phase of connection establishment.

The set\_record\_packets bif can be used to write the packets of a  
connection to a file (however that code has not seen a lot of testing  
recently - it should work, but I don't really want to guarantee it).

Johanna

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:46pm UTC](https://community.zeek.org/t/extracting-packets-from-a-particular-connection/5678/3 "2022-05-06T15:46:27Z")

</div>