# TCP reassembly question \[Port Traffic Mirroring\] **URL:** \ **Category:** Zeek\ **Created:** [August 18, 2017, 7:21am UTC](https://community.zeek.org/t/tcp-reassembly-question-port-traffic-mirroring/4993 "2017-08-18T07:21:53Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![Alkene\_Pan](https://avatars.discourse-cdn.com/v4/letter/a/58956e/32.png) [@Alkene\_Pan](https://community.zeek.org/u/Alkene_Pan)\ **Post date:** [August 18, 2017, 7:21am UTC](https://community.zeek.org/t/tcp-reassembly-question-port-traffic-mirroring/4993/1 "2017-08-18T07:21:53Z")
I encountered a tcp reassembly problem, that begets the bro parse the tcp stream fail. Sincere search for solutions. The following is a description of the problem. There are two pcap file, the pcap data capture from switch(Port Traffic Mirroring). As below: - pcap1, we are use bro to parse the pcap1 file. Been testing, bro can not log http request. I am not sure whether the TCP stream has some messy. - pcap2, base on the pcap1, we were use wireshark to deleted a packet and generated another new pcap2 file. The deleted packet’s status was described as “[TCP ACKed unseen segment]” in wireshark. The bro parse the pcap correctly. Is there any suggestion to solve the problem. Thanks very much. Below listed the test step and results: Bro with capture-loss loaded: root@sensor ~/temp# cat loss.bro @load misc/capture-loss.bro [PACP1\_single\_issue\_00.pcap](https://community.zeek.org/uploads/short-url/xQOwyV3BWKjPwy2Ieuk0WtuOZas.pcap) (13.7 KB) [PCAP2\_single\_issue\_00\_removed\_bad\_packet.pcap](https://community.zeek.org/uploads/short-url/gHy1SB9YHmX4hV2qyhfGJBmfW2D.pcap) (13.7 KB) ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:45pm UTC](https://community.zeek.org/t/tcp-reassembly-question-port-traffic-mirroring/4993/2 "2022-05-06T15:45:13Z")