# TimeStamp of Bro output

**URL:** <https://community.zeek.org/t/timestamp-of-bro-output/2551>\
**Category:** Zeek\
**Created:** [February 7, 2013, 10:31pm UTC](https://community.zeek.org/t/timestamp-of-bro-output/2551 "2013-02-07T22:31:20Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vlad\_Grigorescu2](https://avatars.discourse-cdn.com/v4/letter/v/c4cdca/32.png) [@Vlad\_Grigorescu2](https://community.zeek.org/u/Vlad_Grigorescu2)\
**Post date:** [February 7, 2013, 10:31pm UTC](https://community.zeek.org/t/timestamp-of-bro-output/2551/1 "2013-02-07T22:31:20Z")

</div>

Hi,

I believe what you're seeing is a result of how those timestamps are defined.

In conn.log[1]: "This is the time of the first packet."  
In http.log[2]: "Timestamp for when the request happened."

The conn record doesn't get written until the connection closes (or times out). It happens during the connection\_state\_remove[3] event. By handling it at connection close, you get duration, byte/packet counts, etc.

Also, the times for when the first packet was seen, and when the actual HTTP request was seen can be slightly off.

Does this line up with what you're seeing?

&nbsp;&nbsp;--Vlad

[1] - \<[http://www.bro-ids.org/documentation/scripts/base/protocols/conn/main.html#type-Conn::Info](http://www.bro-ids.org/documentation/scripts/base/protocols/conn/main.html#type-Conn::Info)\>  
[2] - \<[http://www.bro-ids.org/documentation/scripts/base/protocols/http/main.html#type-HTTP::Info](http://www.bro-ids.org/documentation/scripts/base/protocols/http/main.html#type-HTTP::Info)\>  
[3] - \<[http://www.bro-ids.org/documentation/scripts/base/event.bif.html#id-connection\_state\_remove](http://www.bro-ids.org/documentation/scripts/base/event.bif.html#id-connection_state_remove)\>

---

<div class="post-metadata">

**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\
**Post date:** [February 7, 2013, 10:56pm UTC](https://community.zeek.org/t/timestamp-of-bro-output/2551/2 "2013-02-07T22:56:53Z")

</div>

Correct, and in particular log lines are explicitly not sorted by  
time.

Robin

---

<div class="post-metadata">

**Author:** ![keqhe](https://avatars.discourse-cdn.com/v4/letter/k/ed655f/32.png) [@keqhe](https://community.zeek.org/u/keqhe)\
**Post date:** [February 8, 2013, 11:00pm UTC](https://community.zeek.org/t/timestamp-of-bro-output/2551/3 "2013-02-08T23:00:48Z")

</div>

Hi Robin and Vlad,

according to the bro documentation,  
[http://www.bro-ids.org/documentation/scripts/base/protocols/conn/main.html](http://www.bro-ids.org/documentation/scripts/base/protocols/conn/main.html)

there is a 'uid' field in conn.log that is a unique flow identifier. Can  
we use uid to identify the same flow in conn.log and http.log/ssl.log?  
Timestamp is not suitable for flow identification.

Thanks!

---

<div class="post-metadata">

**Author:** ![keqhe](https://avatars.discourse-cdn.com/v4/letter/k/ed655f/32.png) [@keqhe](https://community.zeek.org/u/keqhe)\
**Post date:** [February 8, 2013, 11:04pm UTC](https://community.zeek.org/t/timestamp-of-bro-output/2551/4 "2013-02-08T23:04:57Z")

</div>

> Hi Robin and Vlad,
> 
> according to the bro documentation,  
> [http://www.bro-ids.org/documentation/scripts/base/protocols/conn/main.html](http://www.bro-ids.org/documentation/scripts/base/protocols/conn/main.html)
> 
> there is a 'uid' field in conn.log that is a unique flow identifier. Can  
> we use uid to identify the same flow in conn.log and http.log/ssl.log?  
> Timestamp is not suitable for flow identification.

The important info we want to know is that---there are more than  
50,000,000 flows in the trace files. SO we are not sure whether uid filed  
is really UNIQUE.

---

<div class="post-metadata">

**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\
**Post date:** [February 8, 2013, 11:11pm UTC](https://community.zeek.org/t/timestamp-of-bro-output/2551/5 "2013-02-08T23:11:31Z")

</div>

Indeed, that's the idea behind it. It's unique and identifies flows  
across all logs (and even across Bro runs).

Internally it's a hash value so there's a tiny chance for a collision,  
but it's a 64-bit value space so you should be fine.

Robin

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:40pm UTC](https://community.zeek.org/t/timestamp-of-bro-output/2551/6 "2022-05-06T15:40:46Z")

</div>