# Reassembling packets during inspection **URL:** \ **Category:** Zeek\ **Created:** [August 8, 2010, 1:10am UTC](https://community.zeek.org/t/reassembling-packets-during-inspection/1648 "2010-08-08T01:10:03Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Pete](https://avatars.discourse-cdn.com/v4/letter/p/3ab097/32.png) [@Pete](https://community.zeek.org/u/Pete)\ **Post date:** [August 8, 2010, 1:10am UTC](https://community.zeek.org/t/reassembling-packets-during-inspection/1648/1 "2010-08-08T01:10:03Z")
Is it possible to reassemble TCP and UDP streams while Bro inspects a captured tracefile from a different machine? I have several pcap files that contain approx 6 hrs worth of traffic. I would like to have Bro analyze the data, but I also need the streams (both tcp and udp) reassembled and stored on the hard drive for use with custom python scripts. I've noticed that the contents.bro script will reassemble TCP streams, but it doesn't appear to assemble UDP as well. Any help with this would be greatly appreciated. I have read through the quick start, wiki, and list archives with no luck. I am new to Bro so sorry if this is a basic question. Thanks in advance... I'm running Bro 1.5 ---
**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\ **Post date:** [August 8, 2010, 1:20am UTC](https://community.zeek.org/t/reassembling-packets-during-inspection/1648/2 "2010-08-08T01:20:03Z")
> Is it possible to reassemble TCP and UDP streams while Bro inspects a What do you mean by reassembling a UDP stream? These don't have a particular reassembly ordering associated with them. If you just want to extract the contents of a given UDP flow, you can do so using tcpdump directly.     Vern ---
**Author:** ![Pete](https://avatars.discourse-cdn.com/v4/letter/p/3ab097/32.png) [@Pete](https://community.zeek.org/u/Pete)\ **Post date:** [August 8, 2010, 1:33am UTC](https://community.zeek.org/t/reassembling-packets-during-inspection/1648/3 "2010-08-08T01:33:33Z")
> > Is it possible to reassemble TCP and UDP streams while Bro inspects a > > What do you mean by reassembling a UDP stream? These don't have a particular > reassembly ordering associated with them. If you just want to extract the > contents of a given UDP flow, you can do so using tcpdump directly. Thanks for the quick response. I realize that UDP doesn't have sequence numbers, etc, but I was hoping that Bro would be able to assemble the flow into something that could be externally processed. As a crude example (I realize that Bro has DNS analyzers), but I wanted a file that contained the raw dns request and raw dns reply. I work with malware a lot and I have scripts that look for custom protocols. ---
**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\ **Post date:** [August 13, 2010, 6:26am UTC](https://community.zeek.org/t/reassembling-packets-during-inspection/1648/4 "2010-08-13T06:26:59Z")
> I realize that UDP doesn't have > sequence numbers, etc, but I was hoping that Bro would be able to > assemble the flow into something that could be externally processed. Yeah, I see your point, but no, it doesn't have that in it. It wouldn't be hard to add in simplistic terms (i.e., append the payload of every new datagram in a flow to the end of the content file). Doing it in a semantic- aware fashion would of course be considerably trickier.     Vern ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:39pm UTC](https://community.zeek.org/t/reassembling-packets-during-inspection/1648/5 "2022-05-06T15:39:08Z")