# TCP Conn Log

**URL:** <https://community.zeek.org/t/tcp-conn-log/4754>\
**Category:** Zeek\
**Created:** [April 3, 2017, 12:49pm UTC](https://community.zeek.org/t/tcp-conn-log/4754 "2017-04-03T12:49:21Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mike\_anastasakis](https://avatars.discourse-cdn.com/v4/letter/m/6bbea6/32.png) [@mike\_anastasakis](https://community.zeek.org/u/mike_anastasakis)\
**Post date:** [April 3, 2017, 12:49pm UTC](https://community.zeek.org/t/tcp-conn-log/4754/1 "2017-04-03T12:49:21Z")

</div>

Hello,

I am using Bro for a project and I have a question regarding it’s capabilities.  
Currently when I have a long TCP connection that includes frequent TCP Keep Alive messages, bro is reassembling the whole network trace into one connection and presents it in conn.log with a big duration value. Is it possible to make bro split up TCP connections into smaller fragments based on a interval I set up or at least whenever a TCP Keep alive handshake takes place?

Regards,  
Mike

---

<div class="post-metadata">

**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\
**Post date:** [April 5, 2017, 4:28pm UTC](https://community.zeek.org/t/tcp-conn-log/4754/2 "2017-04-05T16:28:46Z")

</div>

Hi Mike,

I am currently not aware of any way to accomplish this without  
modifications to the core. You can change the timeout that Bro uses for  
TCP connections (the time after which its expires a connection, if it does  
not see any packets) by changing tcp\_inactivity\_timeout; depending on your  
specific application, maybe that might be good enough.

Johanna

---

<div class="post-metadata">

**Author:** ![Azoff\_Justin\_S](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@Azoff\_Justin\_S](https://community.zeek.org/u/Azoff_Justin_S)\
**Post date:** [April 5, 2017, 4:40pm UTC](https://community.zeek.org/t/tcp-conn-log/4754/3 "2017-04-05T16:40:52Z")

</div>

Oh! there is this script that may help:

[https://github.com/corelight/bro-long-connections](https://github.com/corelight/bro-long-connections)

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:44pm UTC](https://community.zeek.org/t/tcp-conn-log/4754/4 "2022-05-06T15:44:47Z")

</div>

Closed on May 6, 2022, 3:44pm UTC