# Traffic characteristics extraction with Bro **URL:** \ **Category:** Zeek\ **Created:** [January 22, 2007, 9:55pm UTC](https://community.zeek.org/t/traffic-characteristics-extraction-with-bro/1110 "2007-01-22T21:55:04Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Duc\_T\_Ha](https://avatars.discourse-cdn.com/v4/letter/d/9fc348/32.png) [@Duc\_T\_Ha](https://community.zeek.org/u/Duc_T_Ha)\ **Post date:** [January 22, 2007, 9:55pm UTC](https://community.zeek.org/t/traffic-characteristics-extraction-with-bro/1110/1 "2007-01-22T21:55:04Z")
Hi, I am trying to extract some flow characteristics from static data with Bro. I've checked the analyzer Conn.bro, but didn't find any suitable information. At present, the characteristics I need are: mean packet size and mean packet inter-arrival time, all per flow. Future work may require packet related information, also per flow. Does anybody know how to do this ? Bro's manual doesn't provide much information about static traffic analysis. Where should I start and what should I do now? I am also quite new with Bro, so any detail is appreciated. Thanks in advance, Duc. ---
**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\ **Post date:** [January 25, 2007, 11:20pm UTC](https://community.zeek.org/t/traffic-characteristics-extraction-with-bro/1110/2 "2007-01-25T23:20:52Z")
> I am trying to extract some flow characteristics from static data with > Bro. I've checked the analyzer Conn.bro, but didn't find any suitable > information. Check out analy.bro, which does this sort of analysis on whatever connections Bro is processing (so you need to load additional scripts to capture the packets of interest). You may need to extend it by editing TCPStats\_Endpoint::DataSent in TCP.cc. > At present, the characteristics I need are: mean packet size and mean > packet inter-arrival time, all per flow. Note, if you just want means, then you can track this quite cheaply. (And mean inter-arrival time is just duration divided by number of packets.)     Vern ---
**Author:** ![Duc\_T\_Ha](https://avatars.discourse-cdn.com/v4/letter/d/9fc348/32.png) [@Duc\_T\_Ha](https://community.zeek.org/u/Duc_T_Ha)\ **Post date:** [January 26, 2007, 4:04pm UTC](https://community.zeek.org/t/traffic-characteristics-extraction-with-bro/1110/3 "2007-01-26T16:04:59Z")
Thank you all for the tips. For those who are interested, here're some observations: 1\> I used "tcp\_packet" event to capture packets. To test this event, I summed up all packet sizes from the input argument "len" and "is\_orig" for each flow. Finally, I compared the sum values (for both directions) with the values returned by "conn\_size", as in the analy.bro The result is interesting: for ALL connections, the total size from the ORIGINATOR side is an exact match, but for many connections, my values for the RESPONDER side are higher and the discrepancies depend on the total size. Is there a bug, Vern ? 2\> Applying similar method for event "new\_packet" (using the field "dl" in tcp\_hdr) gived me the discrepancies of ten folds, for each direction. So I guess tcp\_packet is more suitable :), although I don't know why. 3\> I found that handling packet level events (such as tcp\_packet) made Bro run out of memory when analyzing a CRedII trace with lots of scans - even if the handler does nothing. Bro works fine, though, if I don't capture these events. 4\> It would be nice if there's an overview explanation about the Bro CC code, for someone who needs to extend or modify the code. Doesn't have to be long, one or 2 pages are fine. Also it would be great if we have a page for people to share useful policy/scripts files. I'd be happy to contribute. 5\> I really like the Bro language and is learning a lot from Bro. Thanks for creating such a wonderful tool. Duc Ha Vern Paxson wrote: ---
**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\ **Post date:** [February 3, 2007, 1:14am UTC](https://community.zeek.org/t/traffic-characteristics-extraction-with-bro/1110/4 "2007-02-03T01:14:19Z")
> The result is interesting: for ALL connections, the total size from the > ORIGINATOR side is an exact match, but for many connections, my values > for the RESPONDER side are higher and the discrepancies depend on the > total size. > Is there a bug, Vern ? It's likely that the responder side is more likely to retransmit packets. The usual way to diagnose something like this is pick the largest "offender", extract the corresponding packet trace, and inspect it by hand. > 3\> I found that handling packet level events (such as tcp\_packet) made > Bro run out of memory when analyzing a CRedII trace with lots of scans - > even if the handler does nothing. Bro works fine, though, if I don't > capture these events. That certainly suggests a leak. As we don't use tcp\_packet in production use, we haven't tripped across this before. > 4\> It would be nice if there's an overview explanation about the Bro CC > code, for someone who needs to extend or modify the code. Doesn't have > to be long, one or 2 pages are fine. Well, I don't know about "doesn't have to be long" - it is, after all, more than 100,000 lines of code. In any case, we're aware that this would be nice to have, but it's in fact a great deal of work, beyond our present resources (since we're funded primarily for research rather than development). > Also it would be great if we have > a page for people to share useful policy/scripts files. We have the beginnings of this in   [http://www.bro-ids.org/wiki/index.php/Category:User\_Contributions](http://www.bro-ids.org/wiki/index.php/Category:User_Contributions) though at present we do not provide public edit-access to the Wiki, but rather populate this based on contributions folks send us. Alternatively, one can use the mailing list for this, until a contribution is developed and stable enough to merit widespread use. > 5\> I really like the Bro language and is learning a lot from Bro. > Thanks for creating such a wonderful tool. Very pleased to hear it!     Vern ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:38pm UTC](https://community.zeek.org/t/traffic-characteristics-extraction-with-bro/1110/5 "2022-05-06T15:38:08Z")