# Host field empty in http.log

**URL:** <https://community.zeek.org/t/host-field-empty-in-http-log/6337>\
**Category:** Zeek\
**Created:** [May 6, 2021, 1:28am UTC](https://community.zeek.org/t/host-field-empty-in-http-log/6337 "2021-05-06T01:28:30Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![craig\_bowser](https://avatars.discourse-cdn.com/v4/letter/c/50afbb/32.png) [@craig\_bowser](https://community.zeek.org/u/craig_bowser)\
**Post date:** [May 6, 2021, 1:28am UTC](https://community.zeek.org/t/host-field-empty-in-http-log/6337/1 "2021-05-06T01:28:30Z")

</div>

Forgot a subject…

---

<div class="post-metadata">

**Author:** ![Ankith\_Kumar\_Hanuman](https://avatars.discourse-cdn.com/v4/letter/a/f04885/32.png) [@Ankith\_Kumar\_Hanuman](https://community.zeek.org/u/Ankith_Kumar_Hanuman)\
**Post date:** [May 6, 2021, 1:42am UTC](https://community.zeek.org/t/host-field-empty-in-http-log/6337/2 "2021-05-06T01:42:22Z")

</div>

Does tcpdump on the interface see the packets for http traffic you’re expecting? Is the adapter in promiscuous mode? Have you tried running zeek over a pcap with some HTTP data to see if the log is created?  
Mike

---

<div class="post-metadata">

**Author:** ![Doug\_Burks](https://avatars.discourse-cdn.com/v4/letter/d/ee7513/32.png) [@Doug\_Burks](https://community.zeek.org/u/Doug_Burks)\
**Post date:** [May 6, 2021, 10:19am UTC](https://community.zeek.org/t/host-field-empty-in-http-log/6337/3 "2021-05-06T10:19:19Z")

</div>

Hi Craig,

Have you tried disabling NIC offloading features?  
[https://blog.securityonion.net/2011/10/when-is-full-packet-capture-not-full.html](https://blog.securityonion.net/2011/10/when-is-full-packet-capture-not-full.html)

---

<div class="post-metadata">

**Author:** ![craig\_bowser](https://avatars.discourse-cdn.com/v4/letter/c/50afbb/32.png) [@craig\_bowser](https://community.zeek.org/u/craig_bowser)\
**Post date:** [May 6, 2021, 2:17pm UTC](https://community.zeek.org/t/host-field-empty-in-http-log/6337/4 "2021-05-06T14:17:03Z")

</div>

First, Doug good to ‘hear’ you again.

Second, I disabled the offloading and that seemed to work.

Per Mike’s suggestion, I was using this command

tcpdump -vvAls0 | grep ‘Host:’

to look for http traffic and capture the host names. That’s from this site: [https://danielmiessler.com/study/tcpdump/#host](https://danielmiessler.com/study/tcpdump/#host)

with these two steps, I saw I could view the host name and then I saw the host field being captured in http.log file. Also, was being captured in ssl.log file (although I know it’s called something else in that file) for https sites.

Thanks

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:47pm UTC](https://community.zeek.org/t/host-field-empty-in-http-log/6337/5 "2022-05-06T15:47:39Z")

</div>