# on some peculiar alarms **URL:** \ **Category:** Zeek\ **Created:** [September 30, 2003, 5:44am UTC](https://community.zeek.org/t/on-some-peculiar-alarms/413 "2003-09-30T05:44:09Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\ **Post date:** [September 30, 2003, 5:44am UTC](https://community.zeek.org/t/on-some-peculiar-alarms/413/1 "2003-09-30T05:44:09Z")
> Since this list is the only forum on Bro Actually, it's not, there's also bro-devel@lbl.gov, for discussion of new Bro releases and Bro development issues, though I don't seem to be able to get folks to use it. > I will shoot my question here > (even not being sure whether its appropriate) 🙂 (it strikes me as appropriate here) > I keep seing this alert - ContentGap - in HTTP and SMTP traffic. What does > it actually mean? One addition to Ruoming's reply: you will also get this running off-line on trace files that are missing some of the connection packets due to them being omitted when the trace was originally recorded (for example, due to calls to set\_record\_packets()). > On anothet note, there seems to be a minor bug in dropped packet counting. > Here is what I got today: > > 1064520794.493349 DroppedPackets dropped 633 packets out of -692 received Here Bro is only reporting what libpcap passes along to it. So this likely reflects a deficiency/inconsistency in how the kernel reports the number of received packets to libpcap. What OS are you running under?     Vern ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:36pm UTC](https://community.zeek.org/t/on-some-peculiar-alarms/413/2 "2022-05-06T15:36:50Z")