# ScanSummary intervals **URL:** \ **Category:** Zeek\ **Created:** [February 7, 2006, 7:50pm UTC](https://community.zeek.org/t/scansummary-intervals/922 "2006-02-07T19:50:14Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Joncarlo\_Ruggieri1](https://avatars.discourse-cdn.com/v4/letter/j/e480ec/32.png) [@Joncarlo\_Ruggieri1](https://community.zeek.org/u/Joncarlo_Ruggieri1)\ **Post date:** [February 7, 2006, 7:50pm UTC](https://community.zeek.org/t/scansummary-intervals/922/1 "2006-02-07T19:50:14Z")
Hi, We are running Bro 0.9a8. I am trying to track down an inconsistency with our alarm logs. Our thresholds for reporting AddressScans from external hosts is defined in scan.bro as follows:    const report\_peer\_scan = {            20, 100, 1000, 10000, 50000, 100000, 250000, 500000, 1000000,    } &redef; This is not redefined elsewhere. I see AddressScan alarms for a given host when they reach our first defined threshold of 20. I don't see entries for the next threshold of 100. However, when we checkpoint Bro, we see ScanSummary log entries for higher counts. (We checkpoint Bro every 3 hours.) Also, we can see ScanSummary entries for hosts that did not have AddressScan entries during this last log/checkpoint period. My questions are: 1) Is there something else which might override the report\_peer\_scan thresholds? 2) Should checkpointing Bro reset the ScanSummary count, or will we need to force that?    2A) How do we force the ScanSummary count to reset? Our ultimate goal is to be able to determine the number of addresses scanned by a host at the end of our 3-hour checkpoint interval. That count could be either the true number or else last threshold reached. Thanks for your help! Joncarlo Ruggieri University of CA, Davis Data Center & Client Services ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [February 8, 2006, 3:19am UTC](https://community.zeek.org/t/scansummary-intervals/922/2 "2006-02-08T03:19:57Z")
> 1) Is there something else which might override the report\_peer\_scan > thresholds? If I recall correctly, a source is no longer reported when it has performed shut\_down\_thresh connection attempts (default: 100). Instead Bro then just generates a ScanSummary after 1 day or at termination, whatever comes first. > 2) Should checkpointing Bro reset the ScanSummary count, or will we need > to force that? It will be reset; by default Bro does not carry state across restarts (it may though by declaring things as &persistent). Robin P.S.: You wrote, you're checkpointing every 3 hours. Do you do this primarily to avoid running out of memory? If yes: in newer (development) versions, we've greatly improved the state management, so this may become unneccesarry eventually. ---
**Author:** ![Jean-Philippe\_Luigg2](https://avatars.discourse-cdn.com/v4/letter/j/aeb1de/32.png) [@Jean-Philippe\_Luigg2](https://community.zeek.org/u/Jean-Philippe_Luigg2)\ **Post date:** [February 8, 2006, 3:21pm UTC](https://community.zeek.org/t/scansummary-intervals/922/3 "2006-02-08T15:21:31Z")
Hello, Do you've any release date ? Thank you. ---
**Author:** ![Brian\_Tierney](https://avatars.discourse-cdn.com/v4/letter/b/13edae/32.png) [@Brian\_Tierney](https://community.zeek.org/u/Brian_Tierney)\ **Post date:** [February 8, 2006, 3:40pm UTC](https://community.zeek.org/t/scansummary-intervals/922/4 "2006-02-08T15:40:00Z")
The "1.x development release" at [http://www.bro-ids.org/download.html](http://www.bro-ids.org/download.html) has these fixes. ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [February 8, 2006, 7:04pm UTC](https://community.zeek.org/t/scansummary-intervals/922/5 "2006-02-08T19:04:28Z")
Yet there are still a few more tweaks coming up which are not yet included. Essentially we're going to switch to a memory-efficient default configuration. Instead of requiring to load reduce-memory for effective use in large networks, there'll be the opposite then: an expensive-analysis.bro which can be loaded if the network volume permits. Robin ---
**Author:** ![Jean-Philippe\_Luigg2](https://avatars.discourse-cdn.com/v4/letter/j/aeb1de/32.png) [@Jean-Philippe\_Luigg2](https://community.zeek.org/u/Jean-Philippe_Luigg2)\ **Post date:** [February 8, 2006, 7:43pm UTC](https://community.zeek.org/t/scansummary-intervals/922/6 "2006-02-08T19:43:28Z")
Hello, The one you're speaking about seems to be the 1.0 release (oct 2005). If this isn't a normal release instead of a development's one ? Best regards. ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:37pm UTC](https://community.zeek.org/t/scansummary-intervals/922/7 "2022-05-06T15:37:47Z")