# source ip and destination ip have been swaped in bro logs **URL:** \ **Category:** Zeek\ **Created:** [October 6, 2017, 11:27am UTC](https://community.zeek.org/t/source-ip-and-destination-ip-have-been-swaped-in-bro-logs/5050 "2017-10-06T11:27:19Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Ul\_Asad\_Hafiz](https://avatars.discourse-cdn.com/v4/letter/u/dec6dc/32.png) [@Ul\_Asad\_Hafiz](https://community.zeek.org/u/Ul_Asad_Hafiz)\ **Post date:** [October 6, 2017, 11:27am UTC](https://community.zeek.org/t/source-ip-and-destination-ip-have-been-swaped-in-bro-logs/5050/1 "2017-10-06T11:27:19Z")
Hi, I have noticed in my bor notices.log, that a for a connection, the source\_ip and destination\_ip, as well as the corresponding ports, have been swaped. Is there any explaination for it somewhere and how to find that for which connection bro does this? Regards Asad ---
**Author:** ![seth](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/seth/32/642_2.png) [@seth](https://community.zeek.org/u/seth)\ **Post date:** [October 6, 2017, 1:25pm UTC](https://community.zeek.org/t/source-ip-and-destination-ip-have-been-swaped-in-bro-logs/5050/2 "2017-10-06T13:25:50Z")
Bro will try to get the relationship between who "originated" and "responded" to the connection correct. Let's imagine the case that the initial syn packet for an http connection was dropped so the first packet that Bro saw was source port 80 and the dest port will be some arbitrary high number. Bro will look at the connection and make a guess that it may be looking at the connection backwards and flip it. The fact that the flip happened is also indicated in the "history" field in the conn log with the caret "^". There are a lot of other scenarios that could lead to the same behavior too. If you'd like to go further into the particular case you're encountering, you could send a conn log entry that looks problematic to the list (with IP addresses hidden) and we may be able to diagnose the particular problem you're seeing.    .Seth ---
**Author:** ![Ul\_Asad\_Hafiz](https://avatars.discourse-cdn.com/v4/letter/u/dec6dc/32.png) [@Ul\_Asad\_Hafiz](https://community.zeek.org/u/Ul_Asad_Hafiz)\ **Post date:** [October 6, 2017, 2:08pm UTC](https://community.zeek.org/t/source-ip-and-destination-ip-have-been-swaped-in-bro-logs/5050/3 "2017-10-06T14:08:59Z")
Thanks for this, this is really useful. Asad ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:45pm UTC](https://community.zeek.org/t/source-ip-and-destination-ip-have-been-swaped-in-bro-logs/5050/4 "2022-05-06T15:45:19Z")