# flow-level analysis code

**URL:** <https://community.zeek.org/t/flow-level-analysis-code/656>\
**Category:** Zeek\
**Created:** [December 16, 2004, 6:18pm UTC](https://community.zeek.org/t/flow-level-analysis-code/656 "2004-12-16T18:18:55Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![yangao](https://avatars.discourse-cdn.com/v4/letter/y/3e96dc/32.png) [@yangao](https://community.zeek.org/u/yangao)\
**Post date:** [December 16, 2004, 6:18pm UTC](https://community.zeek.org/t/flow-level-analysis-code/656/1 "2004-12-16T18:18:55Z")

</div>

Hi,

I think Bro is really a good tool for intrusion detection. However, after I studied the reference manual, I found for offline analysis it can only use tcpdump packet level input. Could it also use flow-level analysis data as input? I want to detect some scan and SYN flooding attacks, does somebody have this kind of flow-level code or experience on this? If so, could you share it with us? Our purpose is purely for research.  
Thx.

Yan Gao

---

<div class="post-metadata">

**Author:** ![Randolph\_Reitz](https://avatars.discourse-cdn.com/v4/letter/r/bb73d2/32.png) [@Randolph\_Reitz](https://community.zeek.org/u/Randolph_Reitz)\
**Post date:** [December 16, 2004, 8:22pm UTC](https://community.zeek.org/t/flow-level-analysis-code/656/2 "2004-12-16T20:22:19Z")

</div>

Fermilab uses a package named 'flow-tools' that was originally developed at Ohio State Unix. The first Google hit is...

[http://www.splintered.net/sw/flow-tools/](http://www.splintered.net/sw/flow-tools/)

Randy Reitz  
Computer Security Team

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:37pm UTC](https://community.zeek.org/t/flow-level-analysis-code/656/3 "2022-05-06T15:37:17Z")

</div>

Closed on May 6, 2022, 3:37pm UTC