# TCP Partial Connection
**URL:** https://community.zeek.org/t/tcp-partial-connection/1046
**Category:** Zeek
**Created:** [November 2, 2006, 4:33am UTC](https://community.zeek.org/t/tcp-partial-connection/1046 "2006-11-02T04:33:04Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Jaya\_Dhanesh](https://community.zeek.org/u/Jaya_Dhanesh)
#### Post date: [November 2, 2006, 4:33am UTC](https://community.zeek.org/t/tcp-partial-connection/1046/1 "2006-11-02T04:33:04Z")
Hi All,
BRO calls the Protocol Analyzers (for Applications using TCP) only after a
TCP three way handshake has happened.
For example the HTTP event handlers are called after the TCP handshake has
happened and BRO recognizes it as
a HTTP traffic by looking at the destination port.
When I run capture files with a few TCP (HTTP) packets, without the
handshake packets the HTTP event handlers were not called in this case. I
suppose BRO will recognize it as TCP packet and then do nothing with the
packet.
How does BRO handle this TCP packets without handshake packets?
Thanks in advance,
Dhanesh.
---
### Author:  [@Vern](https://community.zeek.org/u/Vern)
#### Post date: [November 9, 2006, 8:33am UTC](https://community.zeek.org/t/tcp-partial-connection/1046/2 "2006-11-09T08:33:22Z")
> When I run capture files with a few TCP (HTTP) packets, without the
> handshake packets the HTTP event handlers were not called in this case. I
> suppose BRO will recognize it as TCP packet and then do nothing with the
> packet.
>
> How does BRO handle this TCP packets without handshake packets?
It is customized per analyzer. Some analyzers designate that they
can analyze partial connections, while others cannot. (It boils down
to how likely is the analyzer to be able to synchronize its parsing
given it's starting in the middle of a connection.)
Vern
---
### Author:  [@system](https://community.zeek.org/u/system)
#### Post date: [May 6, 2022, 3:38pm UTC](https://community.zeek.org/t/tcp-partial-connection/1046/3 "2022-05-06T15:38:01Z")