# timer delays between different events for same connection **URL:** \ **Category:** Development\ **Tags:** development\ **Created:** [April 13, 2018, 4:30am UTC](https://community.zeek.org/t/timer-delays-between-different-events-for-same-connection/5259 "2018-04-13T04:30:12Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Aashish\_Sharma1](https://avatars.discourse-cdn.com/v4/letter/a/a88e57/32.png) [@Aashish\_Sharma1](https://community.zeek.org/u/Aashish_Sharma1)\ **Post date:** [April 13, 2018, 4:30am UTC](https://community.zeek.org/t/timer-delays-between-different-events-for-same-connection/5259/1 "2018-04-13T04:30:12Z")
So I am seeing some weird stuff in my sample pcap of scanners. May be too obvious and I am just not seeing why/how of it. Here is the issue : ( I have time in human format for easier read): SO I just pick one session from conn.log and this is the connection in question: (there are many more like this): $ fgrep CspAa42NoEGEaXK4ci conn.log | cf Apr 12 05:37:42 CspAa42NoEGEaXK4ci 191.254.157.138 45107 128.3.97.204 23 tcp - - - - S0 F T 0 S 1 40 0 0 - Now as part of debugging I have dumped network\_time for various events which process this connection: Apr 12 05:37:42 new\_connection CspAa42NoEGEaXK4ci Apr 12 06:13:48 connection\_attempt CspAa42NoEGEaXK4ci Apr 12 06:13:48 connection\_state\_remove CspAa42NoEGEaXK4ci Now my understanding is there are various timers involved upon whose expirations bro infers events such as connection\_attempt, connection\_reset etc etc. Timers such as tcp\_attempt\_delay, tcp\_SYN\_timeout, tcp\_close\_delay amongst others. But all these timers are generally 5 seconds. Q. Why would connection\_attempt event kick in after 36 minutes and 6 seconds ? ( 06:13:48 - 05:37:42 ) ? I have a pcap to share if anyone is interested and replicate on their end. Aashish ---
**Author:** ![seth](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/seth/32/642_2.png) [@seth](https://community.zeek.org/u/seth)\ **Post date:** [April 13, 2018, 11:46am UTC](https://community.zeek.org/t/timer-delays-between-different-events-for-same-connection/5259/2 "2018-04-13T11:46:33Z")
> So I am seeing some weird stuff in my sample pcap of scanners. May be too > obvious and I am just not seeing why/how of it. It's a straight forward answer but not completely obvious. 🙂 > Q. Why would connection\_attempt event kick in after 36 minutes and 6 seconds ? ( > 06:13:48 - 05:37:42 ) ? I bet that you have a jump in timestamps in your pcap. Since Bro's internal clock is driven forward by seeing timestamps associated with packets it's possible that your pcap has a 36 minute jump in timestamps so Bro couldn't have possibly expired anything in the time before that because from its perspective there was an immediate jump in time. You don't normally experience the effects of this behavior in traffic you're sniffing live because you will tend to have many packets every second so you see Bro's clock driven forward in very tiny increments as you would expect. If you go a long time without receiving a packet is when stuff gets tricky.    .Seth ---
**Author:** ![Aashish\_Sharma1](https://avatars.discourse-cdn.com/v4/letter/a/a88e57/32.png) [@Aashish\_Sharma1](https://community.zeek.org/u/Aashish_Sharma1)\ **Post date:** [April 13, 2018, 2:07pm UTC](https://community.zeek.org/t/timer-delays-between-different-events-for-same-connection/5259/3 "2018-04-13T14:07:01Z")
Ah! it is obvious now! Yep that was it. Its a relatively slow scan and I only extracted all activity for this specific source IP out of timemachine. I didn't see this behavior in other test cases because there I pull scanners based on ports so somewhat of more 'fluid' traffic. Thanks, Aashish ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:45pm UTC](https://community.zeek.org/t/timer-delays-between-different-events-for-same-connection/5259/4 "2022-05-06T15:45:42Z")