# how to measure size of data that transfer in connections?

**URL:** <https://community.zeek.org/t/how-to-measure-size-of-data-that-transfer-in-connections/1445>\
**Category:** Zeek\
**Created:** [November 9, 2008, 7:17am UTC](https://community.zeek.org/t/how-to-measure-size-of-data-that-transfer-in-connections/1445 "2008-11-09T07:17:45Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![hossein\_talebi](https://avatars.discourse-cdn.com/v4/letter/h/f17d59/32.png) [@hossein\_talebi](https://community.zeek.org/u/hossein_talebi)\
**Post date:** [November 9, 2008, 7:17am UTC](https://community.zeek.org/t/how-to-measure-size-of-data-that-transfer-in-connections/1445/1 "2008-11-09T07:17:45Z")

</div>

Hi  
i run tcpdump while file(with 4MB size) is downloading with follow filter:  
"tcpdump -w pcapfile1 'tcp and host ’ "  
then i apply filtering on pcapfile1:  
"tcpdump -r pcapfile1 -w pcapfile2 'tcp[tcpflags]&(tcp-syn|tcp-  
fin\>tcp-rst)!=0 ’ "  
then i measured size of data by Bro version :1.2.1  
but results are different(on pcapfile1 is 4MB and on pcapfile2 is 1MB)  
OS: Linux(Fedora Core 8)  
you can perform this work and measure sum of data that is received for two files

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:38pm UTC](https://community.zeek.org/t/how-to-measure-size-of-data-that-transfer-in-connections/1445/2 "2022-05-06T15:38:46Z")

</div>