# how to measure size of data that transfer in connections (SYN FIN RST)?

**URL:** <https://community.zeek.org/t/how-to-measure-size-of-data-that-transfer-in-connections-syn-fin-rst/1446>\
**Category:** Zeek\
**Created:** [November 10, 2008, 12:19pm UTC](https://community.zeek.org/t/how-to-measure-size-of-data-that-transfer-in-connections-syn-fin-rst/1446 "2008-11-10T12:19:31Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![hossein\_talebi](https://avatars.discourse-cdn.com/v4/letter/h/f17d59/32.png) [@hossein\_talebi](https://community.zeek.org/u/hossein_talebi)\
**Post date:** [November 10, 2008, 12:19pm UTC](https://community.zeek.org/t/how-to-measure-size-of-data-that-transfer-in-connections-syn-fin-rst/1446/1 "2008-11-10T12:19:31Z")

</div>

Hi

i want measure size of data that transfer in per side(how many recieve and how many send)

I have downloaded one file with size:almost 4MB  
and capture its with tcpdump(only with filtering on tcp header and on my IP )  
and sum of received data in connections almost is:4MB (this sum have been measured in Bro via field of endpoint size in connection)  
then i filter same output of tcpdump only for tcpflags( **SYN,RST,FIN** ) and save with pcap format  
and sum of received data in connections almost is:1MB

(i run tcpdump while file(with 4MB size) is downloading with follow filter:  
"tcpdump -w pcapfile1 'tcp and host ’ "  
then i apply filtering on pcapfile1:  
"tcpdump -r pcapfile1 -w pcapfile2 'tcp[tcpflags]&(tcp-syn|tcp-  
fin\>tcp-rst)!=0 ’ "  
then i measured size of data by Bro version :1.2.1  
but results are different(on pcapfile1 is 4MB and on pcapfile2 is 1MB)  
OS: Linux(Fedora Core 8) )  
you can perform this work and measure sum of data that is received for two files

i don’t know reason of this repugnance  
i need measure size of data that transfer in per side of connection really while i have filter network traffic only  
for **SYN,RST,FIN packet header**

how to solve this problem?

please help me  
thanks

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:38pm UTC](https://community.zeek.org/t/how-to-measure-size-of-data-that-transfer-in-connections-syn-fin-rst/1446/2 "2022-05-06T15:38:47Z")

</div>