# UDP long running "connections"

**URL:** <https://community.zeek.org/t/udp-long-running-connections/6231>\
**Category:** Zeek\
**Created:** [September 17, 2020, 7:43pm UTC](https://community.zeek.org/t/udp-long-running-connections/6231 "2020-09-17T19:43:11Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ankith\_Kumar\_Hanuman](https://avatars.discourse-cdn.com/v4/letter/a/f04885/32.png) [@Ankith\_Kumar\_Hanuman](https://community.zeek.org/u/Ankith_Kumar_Hanuman)\
**Post date:** [September 17, 2020, 7:43pm UTC](https://community.zeek.org/t/udp-long-running-connections/6231/1 "2020-09-17T19:43:11Z")

</div>

I’m using Zeek 3.1.5.

I need to monitor long running UDP “connections”, some lasting two or three days. If I understand correctly, Zeek only logs UDP connections in conn.log on the connection termination. I would also like to log the start of the connection in conn.log.

Any suggestions on how to start with this?

Thanks

Gary

![MSi](http://www.missionsecure.com/images/MSi_Logo_email.png)

: : : : : : : : : : : : : : : : : : : : : : : : : : :

**Gary Huband**  
_Sr. Software and Systems Engineer_

Office: 434.284.8071 x720  
Direct: 434.260.4995  
[Gary@MissionSecure.com](mailto:Gary@MissionSecure.com)

: : : : : : : : : : : : : : : : : : : : : : : : : : :

This email and any files transmitted with it are confidential and proprietary and intended solely for the use of the individual or entity to whom they are addressed. Any dissemination, distribution or copying of this communication is strictly prohibited without our prior permission. If you received this in error, please contact the sender and delete the material from any computer.

---

<div class="post-metadata">

**Author:** ![Christian](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/christian/32/593_2.png) [@Christian](https://community.zeek.org/u/Christian)\
**Post date:** [September 17, 2020, 8:43pm UTC](https://community.zeek.org/t/udp-long-running-connections/6231/2 "2020-09-17T20:43:06Z")

</div>

Take a look at this Zeek package, Gary:

[https://github.com/corelight/bro-long-connections](https://github.com/corelight/bro-long-connections)

It lets you configure time durations at which it'll log connections to a new log, conn\_long.

If you use Zeek 3.2, you'll see improved memory usage when using it.

Best,  
Christian

---

<div class="post-metadata">

**Author:** ![Ankith\_Kumar\_Hanuman](https://avatars.discourse-cdn.com/v4/letter/a/f04885/32.png) [@Ankith\_Kumar\_Hanuman](https://community.zeek.org/u/Ankith_Kumar_Hanuman)\
**Post date:** [September 17, 2020, 9:44pm UTC](https://community.zeek.org/t/udp-long-running-connections/6231/3 "2020-09-17T21:44:28Z")

</div>

[https://github.com/activecm/rita](https://github.com/activecm/rita) might help you hunt these as well.  
Mike

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:47pm UTC](https://community.zeek.org/t/udp-long-running-connections/6231/4 "2022-05-06T15:47:27Z")

</div>

Closed on May 6, 2022, 3:47pm UTC