# Meaning of Various Acronyms in State Field of Packet **URL:** \ **Category:** Zeek\ **Created:** [September 13, 2018, 1:34pm UTC](https://community.zeek.org/t/meaning-of-various-acronyms-in-state-field-of-packet/5455 "2018-09-13T13:34:17Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Lionel\_Levy](https://avatars.discourse-cdn.com/v4/letter/l/f05b48/32.png) [@Lionel\_Levy](https://community.zeek.org/u/Lionel_Levy)\ **Post date:** [September 13, 2018, 1:34pm UTC](https://community.zeek.org/t/meaning-of-various-acronyms-in-state-field-of-packet/5455/1 "2018-09-13T13:34:17Z")
Hi All, I am looking at a dataset of features that was generated using Bro-IDS. Can someone please explain the meaning of the various acronyms that could be sent in a state field? I can guess some of them. CON … Connected? FIN … Finished? TIM … ?? ECO … ?? INT … Interrupted? RST … Reset? ECR … Echo Reply? URP … ?? CLO … ?? STA … ?? ACC … ?? Thanks much, Lionel ---
**Author:** ![Azoff\_Justin\_S](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@Azoff\_Justin\_S](https://community.zeek.org/u/Azoff_Justin_S)\ **Post date:** [September 13, 2018, 3:15pm UTC](https://community.zeek.org/t/meaning-of-various-acronyms-in-state-field-of-packet/5455/2 "2018-09-13T15:15:54Z")
Are you sure those came from Bro? Bro doesn't have a state field.. it does have a conn\_state field, however the possible values of that field are completely different from what you listed. A google search for "CON FIN TIM ECO INT RST ECR URP CLO STA ACC" finds [http://nsmwiki.org/Argus](http://nsmwiki.org/Argus) which points to your data set being generated from Argus, not Bro. ---
**Author:** ![Lionel\_Levy](https://avatars.discourse-cdn.com/v4/letter/l/f05b48/32.png) [@Lionel\_Levy](https://community.zeek.org/u/Lionel_Levy)\ **Post date:** [September 13, 2018, 4:17pm UTC](https://community.zeek.org/t/meaning-of-various-acronyms-in-state-field-of-packet/5455/3 "2018-09-13T16:17:42Z")
Hi Justin, Thanks for the prompt response. I was looking at the UNSW-NB15 Network Data Set within a journal article titled “UNSW-NB15: a comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set).” According to the paper, there are some matched features for both Argus and Bro-IDS tools. One of these features is called “state”, and is described as the state and its dependent protocol, e.g. ACC, CLO. Maybe the authors made a mistake in the paper and this feature is only generated by Argus. Or maybe I am misinterpreting what the authors meant to convey. Regards, Lionel ---
**Author:** ![Azoff\_Justin\_S](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@Azoff\_Justin\_S](https://community.zeek.org/u/Azoff_Justin_S)\ **Post date:** [September 13, 2018, 5:31pm UTC](https://community.zeek.org/t/meaning-of-various-acronyms-in-state-field-of-packet/5455/4 "2018-09-13T17:31:38Z")
[http://manpages.ubuntu.com/manpages/trusty/man1/ra.1.html](http://manpages.ubuntu.com/manpages/trusty/man1/ra.1.html) describes what all those fields mean.. Bro does have a similar feature, but the data is represented differently and those specific state abbreviations are an argus thing. In bro logs, the different ICMP codes are logged this way: ##! host/port to a destination host/port). Further, ICMP "ports" are to ##! be interpreted as the source port meaning the ICMP message type and ##! the destination port being the ICMP message code. so while argus has URF as a state meaning 'Unreachable need fragmentation' in bro that would just be logged as type 3 code 4 in bro under the port columns. For some of the other fields the information is either in the conn\_state or history fields. The documentation for those is here [https://www.bro.org/sphinx/scripts/base/protocols/conn/main.bro.html#type-Conn::Info](https://www.bro.org/sphinx/scripts/base/protocols/conn/main.bro.html#type-Conn::Info) in bro ACC would show up as an h or H in history and a conn\_state of SF, S1,S2, or S3 (i think?) CLO would show up as f or F in history and a conn\_sate of SF ---
**Author:** ![Lionel\_Levy](https://avatars.discourse-cdn.com/v4/letter/l/f05b48/32.png) [@Lionel\_Levy](https://community.zeek.org/u/Lionel_Levy)\ **Post date:** [September 15, 2018, 7:43pm UTC](https://community.zeek.org/t/meaning-of-various-acronyms-in-state-field-of-packet/5455/5 "2018-09-15T19:43:58Z")
Awesome, thanks! ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:46pm UTC](https://community.zeek.org/t/meaning-of-various-acronyms-in-state-field-of-packet/5455/6 "2022-05-06T15:46:03Z")