# Using Dynamic protocol detection to create a HTTP trace

**URL:** <https://community.zeek.org/t/using-dynamic-protocol-detection-to-create-a-http-trace/1115>\
**Category:** Zeek\
**Created:** [January 30, 2007, 3:42am UTC](https://community.zeek.org/t/using-dynamic-protocol-detection-to-create-a-http-trace/1115 "2007-01-30T03:42:58Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Archit\_Gupta](https://avatars.discourse-cdn.com/v4/letter/a/dfb087/32.png) [@Archit\_Gupta](https://community.zeek.org/u/Archit_Gupta)\
**Post date:** [January 30, 2007, 3:42am UTC](https://community.zeek.org/t/using-dynamic-protocol-detection-to-create-a-http-trace/1115/1 "2007-01-30T03:42:58Z")

</div>

Hi,

Given a trace with all traffic, is it possible to use Bro to produce a  
trace with just the HTTP traffic? Any hints would be appreciated.

Thanks and best regards,

Archit

---

<div class="post-metadata">

**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\
**Post date:** [January 31, 2007, 5:18pm UTC](https://community.zeek.org/t/using-dynamic-protocol-detection-to-create-a-http-trace/1115/2 "2007-01-31T17:18:40Z")

</div>

No, not directly (one of the reasons is that DPD may take the  
decision whether a connection uses HTTP only after a couple of  
packets have already passed; it buffers the payload so that it can  
still analyze the full HTTP session but it does not keep the headers  
so that they could be written out into another trace file).

But perhaps you can use Bro to find all the HTTP connections and  
then extract them in a second post-processing step. Either you  
browse through the notices reported, or you add an event handler for  
protocol\_confirmation (also see detect-protocols.bro) which then  
adds some tag to the connection summaries in conn.log .

Robin

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:38pm UTC](https://community.zeek.org/t/using-dynamic-protocol-detection-to-create-a-http-trace/1115/3 "2022-05-06T15:38:08Z")

</div>