# ip\_bytes and pkts not set in conn.log for cropped UDP packets **URL:** \ **Category:** Zeek\ **Created:** [October 12, 2016, 6:25am UTC](https://community.zeek.org/t/ip-bytes-and-pkts-not-set-in-conn-log-for-cropped-udp-packets/4413 "2016-10-12T06:25:18Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![david](https://avatars.discourse-cdn.com/v4/letter/d/aeb1de/32.png) [@david](https://community.zeek.org/u/david)\ **Post date:** [October 12, 2016, 6:25am UTC](https://community.zeek.org/t/ip-bytes-and-pkts-not-set-in-conn-log-for-cropped-udp-packets/4413/1 "2016-10-12T06:25:18Z")
Hi all, We use bro-2.4.1 to analyze pcap traces with cropped payload. This works fine for TCP and ICMP packets, however orig\_pkts, orig\_ip\_bytes, resp\_pkts and resp\_ip\_bytes are all set to "0" in conn.log for the connections with cropped UDP packets (such as DNS packets with a snaplen of 42). That is, we end up with a conn.log entry stating that no packets were observed for the corresponding connection. I assume this is because no application analyzer is started. How can we still get these fields updated? (-C does not help and orig\_bytes as well as resp\_bytes are set correctly, also I noted that the event udp\_contents is triggered for the packets). Many thanks! David ---
**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\ **Post date:** [October 14, 2016, 2:04pm UTC](https://community.zeek.org/t/ip-bytes-and-pkts-not-set-in-conn-log-for-cropped-udp-packets/4413/2 "2016-10-14T14:04:33Z")
Hello David, > We use bro-2.4.1 to analyze pcap traces with cropped payload. > This works fine for TCP and ICMP packets, however orig\_pkts, > orig\_ip\_bytes, resp\_pkts and resp\_ip\_bytes are all set to "0" in > conn.log for the connections with cropped UDP packets (such as DNS > packets with a snaplen of 42). > That is, we end up with a conn.log entry stating that no packets were > observed for the corresponding connection. > I assume this is because no application analyzer is started. Close, but not quite. The ip\_pkts, ip\_bytes fields are tracked by the connection size analyzer. Roughly speaking, Bro arranges its analyzers in a tree structure. The connection size analyzer is started as a child analyzer of the TCP and the UDP analyzer, meaning it only gets information about packets that is passed on by these analyzers. By default, the UDP analyzer does not forward incomplete packets (where the packet content was not captured due to a small snaplength) to any child analyzer - including the connection size analyzer. Changing this behavior requires patching the c++ source - you could try just removing the if (caplen \>= len) check just before ForwardPacket in UDP.cc -- however, this will probably have other side-effects, because you now are also forwarding incomplete data to other analyzers who might not deal too gracefully with them and generate binpac errors - so you only should do this if you also prevent application layer analyzers from instantiating. The current solution here is not quite satisfying - it would probably be nicer if the connection size analyzer is not a child of tcp/udp, but that is difficult due to other reasons. I hope this helps a little bit, Johanna ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:44pm UTC](https://community.zeek.org/t/ip-bytes-and-pkts-not-set-in-conn-log-for-cropped-udp-packets/4413/3 "2022-05-06T15:44:09Z")