# successful\_RPC\_reply\_to\_invalid\_request and ContentGap **URL:** \ **Category:** Zeek\ **Created:** [August 29, 2005, 4:06pm UTC](https://community.zeek.org/t/successful-rpc-reply-to-invalid-request-and-contentgap/851 "2005-08-29T16:06:06Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![bchen](https://avatars.discourse-cdn.com/v4/letter/b/bbe5ce/32.png) [@bchen](https://community.zeek.org/u/bchen)\ **Post date:** [August 29, 2005, 4:06pm UTC](https://community.zeek.org/t/successful-rpc-reply-to-invalid-request-and-contentgap/851/1 "2005-08-29T16:06:06Z")
Hi everyone,    I used Bro to read a trace file that was captured from a local network. In Bro's log files, the majority of log records are about successful\_RPC\_reply\_to\_invalid\_request and ContentGap. What situations can cause these two alerts? thanks Bing ---
**Author:** ![Ruoming\_Pang](https://avatars.discourse-cdn.com/v4/letter/r/df788c/32.png) [@Ruoming\_Pang](https://community.zeek.org/u/Ruoming_Pang)\ **Post date:** [August 29, 2005, 6:47pm UTC](https://community.zeek.org/t/successful-rpc-reply-to-invalid-request-and-contentgap/851/2 "2005-08-29T18:47:42Z")
> Hi everyone, >   I used Bro to read a trace file that was captured from a local network. In > Bro's log files, the majority of log records are about > successful\_RPC\_reply\_to\_invalid\_request and ContentGap. What situations can > cause these two alerts? "successful\_RPC\_reply\_to\_invalid\_request" is a deficiency to be fixed. Bro marks RPC requests that it does not understand as "invalid", and it gets bewildered when it sees the RPC server understands the requests. Please ignore this for now. "ContentGap" is reported when a TCP segment is not seen but ACK'ed. There can be two cases: (1) most likely, some packets are not captured in the trace file; (2) packets are captured on two interfaces and occasionally get out of order such that some ACKs appear before the corresponding segments. There's little Bro can do with (1), but for (2), Bro can reorder the packets in a small window by TCP sequence number instead of timestamps (redef packet\_sort\_window = 1 sec). I hope it helps. Ruoming ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:37pm UTC](https://community.zeek.org/t/successful-rpc-reply-to-invalid-request-and-contentgap/851/3 "2022-05-06T15:37:39Z")