# Trace Files **URL:** \ **Category:** Zeek\ **Created:** [October 4, 2007, 3:55pm UTC](https://community.zeek.org/t/trace-files/1235 "2007-10-04T15:55:43Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Reed\_Porada](https://avatars.discourse-cdn.com/v4/letter/r/96bed5/32.png) [@Reed\_Porada](https://community.zeek.org/u/Reed_Porada)\ **Post date:** [October 4, 2007, 3:55pm UTC](https://community.zeek.org/t/trace-files/1235/1 "2007-10-04T15:55:43Z")
On the Bro wiki it mentions that Bro can be configured to output captured packets that look suspicious. The documentation regarding trace files seems to stop there. I know there is a -w flag, but that seems to be more related to using bro with the -i option, not for getting suspicious traffic. What do I need to do to configure Bro to output a trace file? That would be one additional capability that I would compliment separating out my TG traffic and other traffic mentioned in the 'Question about Bro Capabilities' thread. Thanks, -Reed ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [October 15, 2007, 12:08am UTC](https://community.zeek.org/t/trace-files/1235/2 "2007-10-15T00:08:43Z")
Which text are you refering to exactly? Apart form -w, the only other thing I can think of is the built-in dump\_current\_packet() whichs save the currently processed packet to disk---with the typical problem that this is not very well defined. Robin ---
**Author:** ![Reed\_Porada](https://avatars.discourse-cdn.com/v4/letter/r/96bed5/32.png) [@Reed\_Porada](https://community.zeek.org/u/Reed_Porada)\ **Post date:** [October 15, 2007, 12:51pm UTC](https://community.zeek.org/t/trace-files/1235/3 "2007-10-15T12:51:11Z")
[http://www.bro-ids.org/wiki/index.php/User\_Manual:\_Bro\_Output#Tracefiles](http://www.bro-ids.org/wiki/index.php/User_Manual:_Bro_Output#Tracefiles) The line there implies something more than -w, which may be simply dump\_current\_packet(). -Reed ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [October 15, 2007, 4:41pm UTC](https://community.zeek.org/t/trace-files/1235/4 "2007-10-15T16:41:01Z")
Actually I'm not sure what this is refering too. 🙂 Robin ---
**Author:** ![Reed\_Porada](https://avatars.discourse-cdn.com/v4/letter/r/96bed5/32.png) [@Reed\_Porada](https://community.zeek.org/u/Reed_Porada)\ **Post date:** [October 15, 2007, 9:33pm UTC](https://community.zeek.org/t/trace-files/1235/5 "2007-10-15T21:33:51Z")
When running bro (1.3.2), I get several 'unmatched\_HTTP\_reply' statements, and looking at the output in http.log I get several '\'. I then printed out the conn\_id for these requests, then did a random sampling of those within the pcap. All of the sessions looked ok, as in no different then the successfully matched request/reply flows. What might cause these unmatched replies? Commandline: bro -r my.pcap http http-request http-reply http-body Thanks, -Reed ---
**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\ **Post date:** [October 31, 2007, 8:03pm UTC](https://community.zeek.org/t/trace-files/1235/6 "2007-10-31T20:03:06Z")
> When running bro (1.3.2), I get several 'unmatched\_HTTP\_reply' > statements, and looking at the output in http.log I get several > '\'. I then printed out the conn\_id for these > requests, then did a random sampling of those within the pcap. All > of the sessions looked ok, as in no different then the successfully > matched request/reply flows. What might cause these unmatched replies? > > Commandline: > bro -r my.pcap http http-request http-reply http-body Any chance you could send us my.pcap?     Vern ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:38pm UTC](https://community.zeek.org/t/trace-files/1235/7 "2022-05-06T15:38:22Z")