# Flow Statistics in BRO **URL:** \ **Category:** Zeek\ **Created:** [October 10, 2007, 7:40pm UTC](https://community.zeek.org/t/flow-statistics-in-bro/1243 "2007-10-10T19:40:37Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Danny\_Nechay](https://avatars.discourse-cdn.com/v4/letter/d/a698b9/32.png) [@Danny\_Nechay](https://community.zeek.org/u/Danny_Nechay)\ **Post date:** [October 10, 2007, 7:40pm UTC](https://community.zeek.org/t/flow-statistics-in-bro/1243/1 "2007-10-10T19:40:37Z")
Hi, I have a trace file (from using TCPdump) and I would like to know how to get the flow statistics of this file using BRO (i.e. what would be the command line argument). Thanks. DAN ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [October 10, 2007, 8:58pm UTC](https://community.zeek.org/t/flow-statistics-in-bro/1243/2 "2007-10-10T20:58:05Z")
"bro -r trace tcp" should do it if you're only concerned about TCP. For UDP and ICMP add "udp" and "icmp" to the command line, respectively. Robin ---
**Author:** ![Danny\_Nechay](https://avatars.discourse-cdn.com/v4/letter/d/a698b9/32.png) [@Danny\_Nechay](https://community.zeek.org/u/Danny_Nechay)\ **Post date:** [October 10, 2007, 9:39pm UTC](https://community.zeek.org/t/flow-statistics-in-bro/1243/3 "2007-10-10T21:39:46Z")
Hi, when I run that command I get the following output (a sample): 1185209476.627097 weird: spontaneous\_RST 1185209476.630111 weird: spontaneous\_RST 1185209476.947233 weird: above\_hole\_data\_without\_any\_acks 1185209478.283928 weird: spontaneous\_FIN 1185209478.798191 weird: above\_hole\_data\_without\_any\_acks 1185209479.339797 weird: spontaneous\_RST 1185209479.943993 weird: spontaneous\_RST 1185209480.904227 weird: spontaneous\_FIN 1185209481.648424 weird: above\_hole\_data\_without\_any\_acks When I was talking about flow statistics, I was looking more for statistics such as total number of packets, average packet size, total bytes, total header (transport plus network layer) bytes, number of caller to callee packets, total caller to callee bytes, total caller to callee payload bytes, total caller to callee header bytes, number of callee to caller packets, total callee to caller payload bytes, and total callee to caller header bytes. Also as an aside, do you know why there are these weird addresses in the scan.bro file because whenever I run bro -r tracefile tcp it always starts with the following lines: /usr/local/bro/policy/scan.bro, line 92: warning: no such host: [j5004.inktomisearch.com](http://j5004.inktomisearch.com) /usr/local/bro/policy/scan.bro, line 92: warning: no such host: [j5005.inktomisearch.com](http://j5005.inktomisearch.com) /usr/local/bro/policy/scan.bro, line 93: warning: no such host: [j5006.inktomisearch.com](http://j5006.inktomisearch.com) /usr/local/bro/policy/scan.bro, line 93: warning: no such host: [j100.inktomi.com](http://j100.inktomi.com) /usr/local/bro/policy/scan.bro, line 93: warning: no such host: [j101.inktomi.com](http://j101.inktomi.com) /usr/local/bro/policy/scan.bro, line 94: warning: no such host: [j3002.inktomi.com](http://j3002.inktomi.com) /usr/local/bro/policy/scan.bro, line 94: warning: no such host: [si3000.inktomi.com](http://si3000.inktomi.com) /usr/local/bro/policy/scan.bro, line 94: warning: no such host: [si3001.inktomi.com](http://si3001.inktomi.com) /usr/local/bro/policy/scan.bro, line 95: warning: no such host: [si3002.inktomi.com](http://si3002.inktomi.com) /usr/local/bro/policy/scan.bro, line 95: warning: no such host: [si3003.inktomi.com](http://si3003.inktomi.com) /usr/local/bro/policy/scan.bro, line 95: warning: no such host: [si4000.inktomi.com](http://si4000.inktomi.com) /usr/local/bro/policy/scan.bro, line 96: warning: no such host: [si4001.inktomi.com](http://si4001.inktomi.com) /usr/local/bro/policy/scan.bro, line 96: warning: no such host: [si4002.inktomi.com](http://si4002.inktomi.com) /usr/local/bro/policy/scan.bro, line 96: warning: no such host: [wm3018.inktomi.com](http://wm3018.inktomi.com) line 1: warning: event handlers never invoked: line 1: warning: account\_tried Thanks. Daniel. ---
**Author:** ![Gregor\_Maier3](https://avatars.discourse-cdn.com/v4/letter/g/5f8ce5/32.png) [@Gregor\_Maier3](https://community.zeek.org/u/Gregor_Maier3)\ **Post date:** [October 10, 2007, 10:39pm UTC](https://community.zeek.org/t/flow-statistics-in-bro/1243/4 "2007-10-10T22:39:26Z")
Danny Nechay wrote: > When I was talking about flow statistics, I was looking more for > statistics such as total number of packets, average packet size, total > bytes, total header (transport plus network layer) bytes, number of > caller to callee packets, total caller > to callee bytes, total caller to callee payload bytes, total caller to > callee header bytes, number of callee to > caller packets, total callee to caller payload bytes, and total callee > to caller header bytes. You can use the one-line connection summaries from bro:    bro -r trace conn This won't give you all the information you're interested in, but it's a starting point. hth gregor - -- Gregor Maier gregor@net.t-labs.tu-berlin.de TU Berlin / Deutsche Telekom Labs gregor.maier@tu-berlin.de Sekr. TEL 4, FG INET www.net.t-labs.tu-berlin.de Ernst-Reuter-Platz 7 10587 Berlin, Germany ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [October 11, 2007, 4:02am UTC](https://community.zeek.org/t/flow-statistics-in-bro/1243/5 "2007-10-11T04:02:46Z")
(Got this mail in private first; here's a copy of my reply to the list.) > 1185209481.648424 weird: above\_hole\_data\_without\_any\_acks You can actually just ignore these messages, or load weird.bro which sends them to weird.log. > When I was talking about flow statistics, I was looking more for statistics > such as total number of packets, average packet size, total bytes, total > header Have you looked into conn.log? Bro doesn't count packets per flow but the rest of the information you're looking for should be in there. (If I understand you correctly that you want \*per-flow\* statistics and not an overall summary of, e.g., bytes in the trace). > Also as an aside, do you know why there are these weird addresses in the > scan.bro file because whenever I run bro -r tracefile tcp it always starts > with the following lines: They are an relict from the past when these hosts still existed, to suppress reporting them as scanners. You can simply remove them from the scan.bro to get rid the warning. Iirc this has alreaby been done in the current development version. Robin ---
**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\ **Post date:** [October 11, 2007, 4:12am UTC](https://community.zeek.org/t/flow-statistics-in-bro/1243/6 "2007-10-11T04:12:16Z")
> Also as an aside, do you know why there are these weird addresses in the > scan.bro file because whenever I run bro -r tracefile tcp it always starts > with the following lines: > > /usr/local/bro/policy/scan.bro, line 92: warning: no such host: > j5004.inktomisearch.com These are historical (they used to actually make good examples!, but those hosts have now gone away). They were recently removed, however - are you using the CURRENT release?     Vern ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:38pm UTC](https://community.zeek.org/t/flow-statistics-in-bro/1243/7 "2022-05-06T15:38:23Z")