# Why does zeek not analyze mirror traffic?

**URL:** <https://community.zeek.org/t/why-does-zeek-not-analyze-mirror-traffic/6776>\
**Category:** Zeek\
**Created:** [November 3, 2022, 11:17am UTC](https://community.zeek.org/t/why-does-zeek-not-analyze-mirror-traffic/6776 "2022-11-03T11:17:46Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![gdqian](https://avatars.discourse-cdn.com/v4/letter/g/76d3ee/32.png) [@gdqian](https://community.zeek.org/u/gdqian)\
**Post date:** [November 3, 2022, 11:17am UTC](https://community.zeek.org/t/why-does-zeek-not-analyze-mirror-traffic/6776/1 "2022-11-03T11:17:46Z")

</div>

Hello!  
I’m new to zeek and recently ran into a problem I couldn’t solve.  
I installed zeek, PF-RING, and AF\_PACKET on a superior server,When I use zeek to analyze my local traffic in real time, it works.  
This is the content of notice.log file.

 ![1](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/e593fb9a495b78ee3a6bd7632e8c524245aa5e91.png)

zeek did analyze the burst traffic I was generating.  
However, when I mirrored the traffic of the other two network segments, zeek could not analyze the burst traffic. At first, I thought that the traffic was too large. However, I only mirrored the traffic of one network segment and zeek could not analyze the burst traffic.  
This is the content of the notice.log file for the connection image port.

 ![2](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/0ed7707fa9c004395a1d306a30c95b56314af643.png)

What confused me was that I could see ssh traffic I was generating in ssh.log.

 ![3](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/783a20e736fdbc55db475a697bdae534cad163e9.png)

I also tried to connect the mirrored traffic directly to my physical network card and found that the problem still occurred, as did the offline packets.

---

<div class="post-metadata">

**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\
**Post date:** [November 21, 2022, 7:02pm UTC](https://community.zeek.org/t/why-does-zeek-not-analyze-mirror-traffic/6776/2 "2022-11-21T19:02:08Z")

</div>

Hi,

problems like these are really hard for us to debug since there are a lot of different things that can go wrong. I would start by creating a pcap of the traffic and see if that works, or if that already fails.

Johanna