# TCP Flow Packet Counts

**URL:** <https://community.zeek.org/t/tcp-flow-packet-counts/1692>\
**Category:** Zeek\
**Created:** [November 3, 2010, 8:49pm UTC](https://community.zeek.org/t/tcp-flow-packet-counts/1692 "2010-11-03T20:49:02Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bryce\_Boe](https://avatars.discourse-cdn.com/v4/letter/b/96bed5/32.png) [@Bryce\_Boe](https://community.zeek.org/u/Bryce_Boe)\
**Post date:** [November 3, 2010, 8:49pm UTC](https://community.zeek.org/t/tcp-flow-packet-counts/1692/1 "2010-11-03T20:49:02Z")

</div>

Hi,

I'm trying to write a simple bro policy script that uses the default  
TCP policy output format, with the addition of packet counts per flow  
in each direction. For that I'm actually modifying the analy.bro  
script, however I've noticed that with my sample trace, the originator  
packet count is almost always zero. How can I get the endpoint\_status  
to accurately reflect the number of packets sent in both directions  
for the flow? Also am I safe to assume that the number of bytes sent  
in each direction are correct in the endpoint structure?

I tried to trace this problem down a bit and determined that when  
Analyzer::DeliverPacket calls the class's DeliverPacket method, only a  
fraction of the time does it go to TCPStats\_Analyzer::DeliverPacket  
method whereas the remainder of the time the  
TCP\_Analyzer::DeliverPacket method is called. Thus this leads me to  
believe that many of the packets don't have the correct Analyzer class  
(TCPStats\_Analyzer) associated with it, however I am not sure how to  
fix this problem. Any help would be greatly appreciated.

Thanks,  
Bryce Boe

---

<div class="post-metadata">

**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\
**Post date:** [November 4, 2010, 5:54pm UTC](https://community.zeek.org/t/tcp-flow-packet-counts/1692/2 "2010-11-04T17:54:40Z")

</div>

> however I've noticed that with my sample trace, the originator  
> packet count is almost always zero

Can you send along the script you're using and a trace snippet that  
demonstrates the problem? (Also, what version of Bro are you running?)

I tried on a short trace just now and I get packet counts in both directions.  
Could you be using a capture filter that doesn't capture data packets from  
the originator?

&nbsp;&nbsp;&nbsp;&nbsp;Vern

---

<div class="post-metadata">

**Author:** ![Gregor\_Maier](https://avatars.discourse-cdn.com/v4/letter/g/94ad74/32.png) [@Gregor\_Maier](https://community.zeek.org/u/Gregor_Maier)\
**Post date:** [November 4, 2010, 9:06pm UTC](https://community.zeek.org/t/tcp-flow-packet-counts/1692/3 "2010-11-04T21:06:20Z")

</div>

Hi,

The current version of the analy Analyzer isn't working for this.  
Only packets containing TCP payload are passed to the stats analyzer.

I have a branch that, among other things, also correctly tracks packets  
and bytes on the wire (Bro's conn.log sizes are based on sequence  
numbers). I can sent you a pointer to the branch if you want to. Note,  
however, that my branch tracks a bunch of other things per connection  
(including window size, handshake TTL, TCP options, etc., so it need  
more state per connection.  
OTOH, I was planning on integrating just the size counter into Bro  
anyway. If you are interested in that, I can move that topic up on my  
priority list....

cu  
Gregor

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:39pm UTC](https://community.zeek.org/t/tcp-flow-packet-counts/1692/4 "2022-05-06T15:39:13Z")

</div>