# Reading \_all\_ packets

**URL:** <https://community.zeek.org/t/reading-all-packets/511>\
**Category:** Zeek\
**Created:** [May 27, 2004, 4:27pm UTC](https://community.zeek.org/t/reading-all-packets/511 "2004-05-27T16:27:06Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mike\_Muratet](https://avatars.discourse-cdn.com/v4/letter/m/eb9ed0/32.png) [@Mike\_Muratet](https://community.zeek.org/u/Mike_Muratet)\
**Post date:** [May 27, 2004, 4:27pm UTC](https://community.zeek.org/t/reading-all-packets/511/1 "2004-05-27T16:27:06Z")

</div>

Greetings

I am trying to use bro to read tcpdump files for the purposes of  
characterizing network traffic (not just that which is directed to the  
host). It has a more consistent output format than tcpdump, I'm going to  
want to do some filtering at some point, and it might be easier than trying  
to write my own routines from libpcap (maybe). The documentation is robust,  
which is a 'good news'/'bad news' situation. Is there a simple explanation  
for how to make bro report \_everything\_?

Thanks

Mike

---

<div class="post-metadata">

**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\
**Post date:** [May 27, 2004, 5:11pm UTC](https://community.zeek.org/t/reading-all-packets/511/2 "2004-05-27T17:11:10Z")

</div>

What exactly do you mean by "everything"? As you compare Bro to  
tcpdump it sounds like you would like to see every packet. That does  
not really fit into Bro's connection-oriented model. Do you know  
ipsumdump[1]? Perhaps that could be more appropiate here?

Robin

[1] [http://www.icir.org/kohler/ipsumdump/](http://www.icir.org/kohler/ipsumdump/)

---

<div class="post-metadata">

**Author:** ![Mike\_Muratet](https://avatars.discourse-cdn.com/v4/letter/m/eb9ed0/32.png) [@Mike\_Muratet](https://community.zeek.org/u/Mike_Muratet)\
**Post date:** [May 27, 2004, 10:38pm UTC](https://community.zeek.org/t/reading-all-packets/511/3 "2004-05-27T22:38:21Z")

</div>

> \> for how to make bro report \_everything\_?
> 
> What exactly do you mean by "everything"? As you compare Bro to  
> tcpdump it sounds like you would like to see every packet. That does  
> not really fit into Bro's connection-oriented model. Do you know  
> ipsumdump[1]? Perhaps that could be more appropiate here?

Robin

It will be more appropriate.

Thanks

Mike

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:37pm UTC](https://community.zeek.org/t/reading-all-packets/511/4 "2022-05-06T15:37:02Z")

</div>