# trace-summary question **URL:** \ **Category:** Development\ **Tags:** development\ **Created:** [August 5, 2011, 6:30pm UTC](https://community.zeek.org/t/trace-summary-question/1965 "2011-08-05T18:30:17Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Clark\_Gilbert](https://avatars.discourse-cdn.com/v4/letter/c/57b2e6/32.png) [@Clark\_Gilbert](https://community.zeek.org/u/Clark_Gilbert)\ **Post date:** [August 5, 2011, 6:30pm UTC](https://community.zeek.org/t/trace-summary-question/1965/1 "2011-08-05T18:30:17Z")
From trace-summary:         if duration and payload\_resp \* 8 / (1024 \* 1024 \* duration) \> 700:             # Bandwith exceed due to Bro bug.             if Options.conn\_version == 1:                 print \>\>sys.stderr, "%.6f originator exceeds bandwith" % time             else:                 print \>\>sys.stderr, "UID %s originator exceeds bandwith" % f[uid\_idx]             payload\_resp = 0 Just curious: is there a good reason for '700'? --Gilbert ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [August 8, 2011, 4:33am UTC](https://community.zeek.org/t/trace-summary-question/1965/2 "2011-08-08T04:33:58Z")
It's "good enough". 🙂 The problem here is that Bro sometimes reports outrageously high volume: it computes the volume from TCP sequence numbers and gets utterly confused if they wrap around. So anything that looks like an unrealistic bandwidth will do. (Unfortunately, wrap around is more likely to occur for larger connections, and by excluding those we may miss actually a signficiant chunk for the summary. But there's not much to do about that with a given summary; garbage in, garbage out. 🙂 Robin ---
**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\ **Post date:** [August 8, 2011, 5:01am UTC](https://community.zeek.org/t/trace-summary-question/1965/3 "2011-08-08T05:01:23Z")
> (Unfortunately, wrap around is more likely to occur for larger > connections, and by excluding those we may miss actually a signficiant > chunk for the summary. But there's not much to do about that with a > given summary; garbage in, garbage out. 🙂 (Well, there used to be something to do - use large-conns.bro, until it was unceremoniously dumped) ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [August 8, 2011, 5:04am UTC](https://community.zeek.org/t/trace-summary-question/1965/4 "2011-08-08T05:04:53Z")
> (Well, there used to be something to do - use large-conns.bro That's what the part 'with a given summary' was aiming at: if you feed trace-summary a conn.log that already has that problme, there's nothing it can do about it. That's not saying there aren't ways to get the conn.log right in the first place. 🙂 > , until it was unceremoniously dumped) Was it dumped, or is it just not moved over yet? I don't recall. Robin ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [August 8, 2011, 2:33pm UTC](https://community.zeek.org/t/trace-summary-question/1965/5 "2011-08-08T14:33:43Z")
> That's what the part 'with a given summary' was aiming at: if you feed > trace-summary a conn.log that already has that problme, there's > nothing it can do about it. That's not saying there aren't ways to get > the conn.log right in the first place. 🙂 My plan was to enable Gregor's ConnSize analyzer by default. Does it make sense to use the values acquired from that in place of the existing values? > > , until it was unceremoniously dumped) > > Was it dumped, or is it just not moved over yet? I don't recall. Not moved over yet. I didn't dump anything, it's all just waiting to regain it's status in the sun. 🙂   .Seth ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [August 8, 2011, 3:20pm UTC](https://community.zeek.org/t/trace-summary-question/1965/6 "2011-08-08T15:20:03Z")
We should offer both, they have different sematnics. However we could include only the ConnSize one in base (as that's probably what people intuively expect) and offer the current one as an option to add additionally? Robin ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [August 8, 2011, 4:08pm UTC](https://community.zeek.org/t/trace-summary-question/1965/7 "2011-08-08T16:08:58Z")
I think that sounds optimal. We even have the perfect place to put the script that adds that information now (after the latest reorg). 🙂   .Seth ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:39pm UTC](https://community.zeek.org/t/trace-summary-question/1965/8 "2022-05-06T15:39:44Z")