# Split PCAPs & Partial Connections **URL:** \ **Category:** Zeek\ **Created:** [June 6, 2014, 12:34pm UTC](https://community.zeek.org/t/split-pcaps-partial-connections/3139 "2014-06-06T12:34:42Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![user11](https://avatars.discourse-cdn.com/v4/letter/u/dfb087/32.png) [@user11](https://community.zeek.org/u/user11)\ **Post date:** [June 6, 2014, 12:34pm UTC](https://community.zeek.org/t/split-pcaps-partial-connections/3139/1 "2014-06-06T12:34:42Z")
Hello all, I am batch processing some periodic PCAP files to extract SSL certificates. I noticed if I do bro -r file1, followed by bro -r file2, I end up with two ssl.log files totalling ~1500 lines. However, if I mergecap file1 & file2 and run bro -r merged, my ssl.log is ~7000 lines. After searching the list archive and current bro docs, I thought this might be a partial connection problem. So I tried a redef partial\_connection\_ok = T; but that did not seem to have any effect. Any insights into how I might fix the discrepancy would be greatly appreciated. Jason ---
**Author:** ![user11](https://avatars.discourse-cdn.com/v4/letter/u/dfb087/32.png) [@user11](https://community.zeek.org/u/user11)\ **Post date:** [June 9, 2014, 7:59am UTC](https://community.zeek.org/t/split-pcaps-partial-connections/3139/2 "2014-06-09T07:59:55Z")
Has anyone here run into this problem before? It seems to be the same for http.log files as well. Thanks! Jason ---
**Author:** ![Shane\_Castle](https://avatars.discourse-cdn.com/v4/letter/s/77aa72/32.png) [@Shane\_Castle](https://community.zeek.org/u/Shane_Castle)\ **Post date:** [June 9, 2014, 9:17am UTC](https://community.zeek.org/t/split-pcaps-partial-connections/3139/3 "2014-06-09T09:17:08Z")
A few questions arise: How did you run mergecap? Does the behavior change if you run it using -a? Do the two pcap files immediately follow one another in timestamps, that is, does file2 start exactly where file1 stops? Is the merged pcap file about equal to size(file1) plus size(file2), or is it significantly larger? ---
**Author:** ![user11](https://avatars.discourse-cdn.com/v4/letter/u/dfb087/32.png) [@user11](https://community.zeek.org/u/user11)\ **Post date:** [June 9, 2014, 10:00am UTC](https://community.zeek.org/t/split-pcaps-partial-connections/3139/4 "2014-06-09T10:00:37Z")
Shane, I ran mergecap -w merged.cap file1 file2. When run with -a, merged.cap is the same file size, but bro results in only 700 log lines in ssl.log. The two PCAP files are an overlapping timeframe. Traffic is split across both. Yes, the merged file size is approximately the same as the sum of the individual files. Jason ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:41pm UTC](https://community.zeek.org/t/split-pcaps-partial-connections/3139/5 "2022-05-06T15:41:50Z")