# Partial tcpdump traces

**URL:** https://community.zeek.org/t/partial-tcpdump-traces/1324
**Category:** Zeek
**Created:** [April 23, 2008, 6:18am UTC](https://community.zeek.org/t/partial-tcpdump-traces/1324 "2008-04-23T06:18:23Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Danny\_Nechay](https://avatars.discourse-cdn.com/v4/letter/d/a698b9/32.png) [@Danny\_Nechay](https://community.zeek.org/u/Danny_Nechay)
#### Post date: [April 23, 2008, 6:18am UTC](https://community.zeek.org/t/partial-tcpdump-traces/1324/1 "2008-04-23T06:18:23Z")

</div>

Hi,

could you possibly point me towards which files or functions I should look at to get rid of these sanity checks? I know I’m not exactly using Bro for its proper use - I just need it to provide a ground truth for all flows inside of a trace. So far I’ve had no problems with full tcpdump traces, but if I could just find a way for it to handle partial tcpdump traces then it would suit my needs perfectly.  
Thanks.

Daniel.

---

<div class="post-metadata">

### Author: ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)
#### Post date: [April 23, 2008, 7:27pm UTC](https://community.zeek.org/t/partial-tcpdump-traces/1324/2 "2008-04-23T19:27:34Z")

</div>

The one I found is this snippet in TCP.cc:

&nbsp;&nbsp;&nbsp;if ( len \> 0 && (caplen \>= len || packet\_children.size()) &&  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;! flags.RST() && ! Skipping() )  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;need\_contents = DeliverData(t, data, len, caplen, ip, tp,  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;endpoint, base\_seq,  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;is\_orig, flags);  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  
The condition "caplen \>= len" prevents Bro from passing the payload  
on. However, just removing this still doesn't get the data to the  
signature engine so there must be more such checks at other places  
(to check whether the sig engine sees the data, you can configure  
with --enable-debug and then run Bro with "-B rules"; that outputs  
some debugging info into debug.log; your payload should show up in  
there).

Robin

---

<div class="post-metadata">

### Author: ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)
#### Post date: [May 6, 2022, 3:38pm UTC](https://community.zeek.org/t/partial-tcpdump-traces/1324/3 "2022-05-06T15:38:32Z")

</div>