# Notice on duration

**URL:** <https://community.zeek.org/t/notice-on-duration/4058>\
**Category:** Zeek\
**Created:** [March 18, 2016, 9:47pm UTC](https://community.zeek.org/t/notice-on-duration/4058 "2016-03-18T21:47:49Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\
**Post date:** [March 18, 2016, 9:47pm UTC](https://community.zeek.org/t/notice-on-duration/4058/1 "2016-03-18T21:47:49Z")

</div>

Hey all,

I've been tasked with seeing about getting an alert of some kind when a session (tcp/udp/icmp) lasts longer then a certain time. Is this something well suited for bro, or should I go looking at something like ntop-ng instead? Thank you.

James

---

<div class="post-metadata">

**Author:** ![Vlad\_Grigorescu3](https://avatars.discourse-cdn.com/v4/letter/v/dec6dc/32.png) [@Vlad\_Grigorescu3](https://community.zeek.org/u/Vlad_Grigorescu3)\
**Post date:** [March 21, 2016, 4:06pm UTC](https://community.zeek.org/t/notice-on-duration/4058/2 "2016-03-21T16:06:02Z")

</div>

Hi James,

James Lay \<jlay@slave-tothe-box.net\> writes:

> I've been tasked with seeing about getting an alert of some kind when a  
> session (tcp/udp/icmp) lasts longer then a certain time. Is this  
> something well suited for bro...?

It should be. Check out ConnPolling:

[https://www.bro.org/sphinx/scripts/base/protocols/conn/polling.bro.html](https://www.bro.org/sphinx/scripts/base/protocols/conn/polling.bro.html)

This is a little-known feature that hasn't seen much use, but I'd be  
very interested if you get this working for your use-case. So far, it's  
been used to look for large (or fast) connections, such as:

> <https://github.com/JustinAzoff/bro-react/blob/master/conn-bulk.bro>

&nbsp;&nbsp;--Vlad

---

<div class="post-metadata">

**Author:** ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\
**Post date:** [March 21, 2016, 6:12pm UTC](https://community.zeek.org/t/notice-on-duration/4058/3 "2016-03-21T18:12:34Z")

</div>

Thanks Vlad...I'll give this a go.

James

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:43pm UTC](https://community.zeek.org/t/notice-on-duration/4058/4 "2022-05-06T15:43:30Z")

</div>

Closed on May 6, 2022, 3:43pm UTC