# Logging connections after specific daytime

**URL:** <https://community.zeek.org/t/logging-connections-after-specific-daytime/4826>\
**Category:** Development\
**Tags:** development\
**Created:** [May 8, 2017, 12:55pm UTC](https://community.zeek.org/t/logging-connections-after-specific-daytime/4826 "2017-05-08T12:55:25Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dominique\_Krause\_Mei](https://avatars.discourse-cdn.com/v4/letter/d/b2d939/32.png) [@Dominique\_Krause\_Mei](https://community.zeek.org/u/Dominique_Krause_Mei)\
**Post date:** [May 8, 2017, 12:55pm UTC](https://community.zeek.org/t/logging-connections-after-specific-daytime/4826/1 "2017-05-08T12:55:25Z")

</div>

Hello,

i'm currently tying to develop a script for a project scenario and i would like to know if there are some more efficient approaches and/or solutions for the current problem.  
The main task is defined as logging all connections and connection-attempts occuring after a certain daytime.  
At the moment i'm using the functions provided by the script located in base/protocols/conn/main.bro and the following events:  
- bro\_init  
- bro\_done  
- new\_connection  
- connection\_state\_remove  
- content\_gap //not sure about this one

Now i got stuck with a few questions:  
1. Are those events enough to track every connection being established after a certain daytime? Or do i need additional events?  
2. Why does the ../conn/main.bro script fill the c$conn-attributes from Conn::Info (function set\_conn()), if bro provides them automatically after an event is removed from memory?  
3. If i do include other scripts (e.g. base/protocols/dns) why are the records still missing in a connection-object provided by the connection\_state\_remove()-event?  
I think it makes sense if there is a dns-event and the ssl-record is missing, but even if its a dns-event, there is still no dns-record with additional data about the connection. Am i missing something? Do i have to them by myself by using Bro-Functions?  
4. Is it possible to determine how much data was transfered by a specific connection while it is still kept in memory? As an example: Connection was seen at a certain time and finished 10 seconds later. Is it possible to determine the send bytes or protocol 5 seconds after initiation?

-- Dominique

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:44pm UTC](https://community.zeek.org/t/logging-connections-after-specific-daytime/4826/2 "2022-05-06T15:44:55Z")

</div>