# Sometimes HTTP.log fails to generate from PCAP file
**URL:** https://community.zeek.org/t/sometimes-http-log-fails-to-generate-from-pcap-file/5793
**Category:** Zeek
**Created:** [August 8, 2019, 7:42pm UTC](https://community.zeek.org/t/sometimes-http-log-fails-to-generate-from-pcap-file/5793 "2019-08-08T19:42:10Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Jonah\_Burgess](https://community.zeek.org/u/Jonah_Burgess)
#### Post date: [August 8, 2019, 7:42pm UTC](https://community.zeek.org/t/sometimes-http-log-fails-to-generate-from-pcap-file/5793/1 "2019-08-08T19:42:10Z")
Hi Everyone,
This is my first time using this mailing list so I apologise in advance if I’ve followed the wrong format/protocol etc.
I am doing some malware research and making use of the HTTP.log generated by Bro. I’ve noticed some PCAPs fail to generate a HTTP log. I’ve looked at a couple of examples and thought maybe it is because there is no SYN-ACK before the HTTP connection in the PCAP (the researcher who generated the PCAP may have cut this out or not captured it).
Can anybody confirm why the HTTP.log fails to generate (is it the missing SYN-ACK at the start?) and advise if there is some way I can still extract the HTTP traffic from the PCAP using Bro (since it’s clearly all visible in Wireshark).
Note: I’m unable to attach screenshots of any of the problematic PCAPs due to email size…
Thanks in advance,
Jonah (@\_CryptoCat)
---
### Author:  [@Jon\_Siwek](https://community.zeek.org/u/Jon_Siwek)
#### Post date: [August 8, 2019, 8:18pm UTC](https://community.zeek.org/t/sometimes-http-log-fails-to-generate-from-pcap-file/5793/2 "2019-08-08T20:18:10Z")
> Can anybody confirm why the HTTP.log fails to generate (is it the missing SYN-ACK at the start?)
Yes, that's likely the reason -- the HTTP parser (or any parser
really) don't make an attempt to (re)synchronize with the HTTP
protocol in the case we may be starting somewhere in the middle of the
TCP stream.
> and advise if there is some way I can still extract the HTTP traffic from the PCAP using Bro (since it’s clearly all visible in Wireshark).
Not out of the box, but attached is a patch that removes the checks
which currently cause the HTTP analysis to be skipped for such
connections. If all that's missing is the TCP handshake, then the
http.log produced with the patched version I think will be the same or
similar enough to if the handshake were there. If there's more
packets missing than that, it will likely still fail to parse out much
HTTP data.
- Jon
[http-partial.patch](https://community.zeek.org/uploads/short-url/8adt8mFFAp6d9iQ3G0a5NfhKEnS.patch) (718 Bytes)
---
### Author:  [@Charles\_A\_Fair](https://community.zeek.org/u/Charles_A_Fair)
#### Post date: [August 10, 2019, 4:07pm UTC](https://community.zeek.org/t/sometimes-http-log-fails-to-generate-from-pcap-file/5793/3 "2019-08-10T16:07:30Z")
Try this on your pcap file to see all analyzed events:
Bro Dump Events policy script:
bro -C -r file.pcap policy/misc/dump-events.bro
I would also expect if your trace is a partial capture that Bro will create a weird log entry with a description of what’s going on.
Charles “Chuck” A. Fair
[chuck.fair@perched.io](mailto:chuck.fair@perched.io)
Chuck
---
### Author:  [@system](https://community.zeek.org/u/system)
#### Post date: [May 6, 2022, 3:46pm UTC](https://community.zeek.org/t/sometimes-http-log-fails-to-generate-from-pcap-file/5793/4 "2022-05-06T15:46:40Z")