# tx\_hosts and rx\_hosts in files.log **URL:** \ **Category:** Zeek\ **Created:** [May 30, 2015, 7:16pm UTC](https://community.zeek.org/t/tx-hosts-and-rx-hosts-in-files-log/3629 "2015-05-30T19:16:07Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Ali\_Hadi](https://avatars.discourse-cdn.com/v4/letter/a/f08c70/32.png) [@Ali\_Hadi](https://community.zeek.org/u/Ali_Hadi)\ **Post date:** [May 30, 2015, 7:16pm UTC](https://community.zeek.org/t/tx-hosts-and-rx-hosts-in-files-log/3629/1 "2015-05-30T19:16:07Z")
Hi, If you use the PCAP below and analyze it using Bro: [https://www.bro.org/static/traces/email.pcap](https://www.bro.org/static/traces/email.pcap) Then when checking the files.log, the tx\_hosts is supposed to show the host who transmitted the file, and rx\_hosts is for the host who received the file based on Bro’s documentation: [https://www.bro.org/sphinx-git/scripts/base/frameworks/files/main.bro.html](https://www.bro.org/sphinx-git/scripts/base/frameworks/files/main.bro.html) If you do the following: cat files.log | bro-cut fuid tx\_hosts rx\_hosts | grep You’ll get that the TX Host IP (SrcIP) is 192.168.121.176 and not 192.168.121.179 !!! Is there something I’m doing wrong, or has bro switched their positions in the output? ​Thanks in advance, **Ali** ---
**Author:** ![Vlad\_Grigorescu1](https://avatars.discourse-cdn.com/v4/letter/v/f9ae1b/32.png) [@Vlad\_Grigorescu1](https://community.zeek.org/u/Vlad_Grigorescu1)\ **Post date:** [May 31, 2015, 9:35pm UTC](https://community.zeek.org/t/tx-hosts-and-rx-hosts-in-files-log/3629/2 "2015-05-31T21:35:40Z")
Thanks for the bug report. Looks like this comes from the assumption made here: [https://github.com/bro/bro/blob/master/src/analyzer/protocol/mime/MIME.cc#L1459](https://github.com/bro/bro/blob/master/src/analyzer/protocol/mime/MIME.cc#L1459) –Vlad ---
**Author:** ![Ali\_Hadi](https://avatars.discourse-cdn.com/v4/letter/a/f08c70/32.png) [@Ali\_Hadi](https://community.zeek.org/u/Ali_Hadi)\ **Post date:** [June 1, 2015, 10:07am UTC](https://community.zeek.org/t/tx-hosts-and-rx-hosts-in-files-log/3629/3 "2015-06-01T10:07:19Z")
You’re welcome. Hope it will be corrected soon. ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [June 1, 2015, 2:25pm UTC](https://community.zeek.org/t/tx-hosts-and-rx-hosts-in-files-log/3629/4 "2015-06-01T14:25:02Z")
Please file a ticket with our tracker. Robin ---
**Author:** ![Ali\_Hadi](https://avatars.discourse-cdn.com/v4/letter/a/f08c70/32.png) [@Ali\_Hadi](https://community.zeek.org/u/Ali_Hadi)\ **Post date:** [June 1, 2015, 6:44pm UTC](https://community.zeek.org/t/tx-hosts-and-rx-hosts-in-files-log/3629/5 "2015-06-01T18:44:01Z")
Okay Robin, it’s done. ---
**Author:** ![usman\_shafique](https://avatars.discourse-cdn.com/v4/letter/u/b5e925/32.png) [@usman\_shafique](https://community.zeek.org/u/usman_shafique)\ **Post date:** [June 2, 2015, 4:09am UTC](https://community.zeek.org/t/tx-hosts-and-rx-hosts-in-files-log/3629/6 "2015-06-02T04:09:44Z")
can any one tell me how to analyze dynamic protocol in bro i am beginner i just understand bro scripting and how to run please give me simple example thanks Regards USman ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:42pm UTC](https://community.zeek.org/t/tx-hosts-and-rx-hosts-in-files-log/3629/7 "2022-05-06T15:42:43Z")