# Long running connection using threshold

**URL:** <https://community.zeek.org/t/long-running-connection-using-threshold/6065>\
**Category:** Zeek\
**Created:** [March 31, 2020, 7:23pm UTC](https://community.zeek.org/t/long-running-connection-using-threshold/6065 "2020-03-31T19:23:39Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Petr\_Medonos](https://avatars.discourse-cdn.com/v4/letter/p/4af34b/32.png) [@Petr\_Medonos](https://community.zeek.org/u/Petr_Medonos)\
**Post date:** [March 31, 2020, 7:23pm UTC](https://community.zeek.org/t/long-running-connection-using-threshold/6065/1 "2020-03-31T19:23:39Z")

</div>

Hi,  
I tried to write simple script to detect long running connection using  
zeek (3.0) threshold. I set duration in connection established event and  
then using duration\_threshold\_crossed logged connection above the limit.  
But Notice log is then flooded with every new established connection.  
Simple PoC bellow. Did I missed something? Is there any better way to  
detect long running connection? I tried Corelight bro-long-connections  
but there is lot overhead in my environment. Thanks for pointing me the  
right way!

---

<div class="post-metadata">

**Author:** ![Jon\_Siwek](https://avatars.discourse-cdn.com/v4/letter/j/71c47a/32.png) [@Jon\_Siwek](https://community.zeek.org/u/Jon_Siwek)\
**Post date:** [April 6, 2020, 8:43pm UTC](https://community.zeek.org/t/long-running-connection-using-threshold/6065/2 "2020-04-06T20:43:57Z")

</div>

Hi Petr,

Your example code looked correct to me, but I found what simply looked  
like a bug in the connection thresholding code that did the duration  
comparison in reverse of what it should. Here's my proposed patch:  
[https://github.com/zeek/zeek/pull/899](https://github.com/zeek/zeek/pull/899)

- Jon

---

<div class="post-metadata">

**Author:** ![Petr\_Medonos](https://avatars.discourse-cdn.com/v4/letter/p/4af34b/32.png) [@Petr\_Medonos](https://community.zeek.org/u/Petr_Medonos)\
**Post date:** [April 8, 2020, 4:20pm UTC](https://community.zeek.org/t/long-running-connection-using-threshold/6065/3 "2020-04-08T16:20:58Z")

</div>

Hi Jon,  
thanks for the fix. Works like a charm!

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:47pm UTC](https://community.zeek.org/t/long-running-connection-using-threshold/6065/4 "2022-05-06T15:47:10Z")

</div>

Closed on May 6, 2022, 3:47pm UTC