# zeek performance with some events activated **URL:** \ **Category:** Zeek\ **Created:** [April 18, 2019, 7:44am UTC](https://community.zeek.org/t/zeek-performance-with-some-events-activated/5666 "2019-04-18T07:44:23Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Palumbo\_Mauro](https://avatars.discourse-cdn.com/v4/letter/p/7c8e57/32.png) [@Palumbo\_Mauro](https://community.zeek.org/u/Palumbo_Mauro)\ **Post date:** [April 18, 2019, 7:44am UTC](https://community.zeek.org/t/zeek-performance-with-some-events-activated/5666/1 "2019-04-18T07:44:23Z")
Hi Zeek-devs, I need to do some analysis on TCP flags and the event “tcp\_packet” perfectly fits my needs. However, as stated in Zeek’s documentation, using this event may significantly affect Zeek’s performance, given the high number of TCP packets to look into. Is there any other way to look into TCP flags? Would bypassing scriptland and modifyng directly the C++ code be more efficient (though not the “proper” way to do it)? Thanks in advance, Mauro ---
**Author:** ![Jon\_Siwek](https://avatars.discourse-cdn.com/v4/letter/j/71c47a/32.png) [@Jon\_Siwek](https://community.zeek.org/u/Jon_Siwek)\ **Post date:** [April 18, 2019, 4:30pm UTC](https://community.zeek.org/t/zeek-performance-with-some-events-activated/5666/2 "2019-04-18T16:30:21Z")
>      I need to do some analysis on TCP flags and the event “tcp\_packet” perfectly fits my needs. However, as stated in Zeek’s documentation, using this event may significantly affect Zeek’s performance, given the high number of TCP packets to look into. > > Is there any other way to look into TCP flags? No other script-only method comes to mind. > Would bypassing scriptland and modifyng directly the C++ code be more efficient (though not the “proper” way to do it)? Generally, yes. You could always do a quick measurement of whether handling just an empty "tcp\_packet" event is prohibitive for you use-case. If it's not, then some other factors to help decide whether to proceed further with script-only vs. C++ implementation might be: (1) Length of time it would take to fully implement and test the script-only solution. If it's a lot of effort, might be worth just starting from a C++ implementation. (2) Whether you plan to share this work w/ the wider community or it just needs to work for your particular case (for the later a less performant, script-only solution is more acceptable). - Jon ---
**Author:** ![Jim\_Mellander](https://avatars.discourse-cdn.com/v4/letter/j/e47c2d/32.png) [@Jim\_Mellander](https://community.zeek.org/u/Jim_Mellander)\ **Post date:** [April 18, 2019, 4:57pm UTC](https://community.zeek.org/t/zeek-performance-with-some-events-activated/5666/3 "2019-04-18T16:57:19Z")
Another consideration to think about is whether you can run against a pcap offline, or if you need realtime analysis. For offline analysis you can turn off all policies except the one you’re particularly interested in. ---
**Author:** ![Palumbo\_Mauro](https://avatars.discourse-cdn.com/v4/letter/p/7c8e57/32.png) [@Palumbo\_Mauro](https://community.zeek.org/u/Palumbo_Mauro)\ **Post date:** [April 19, 2019, 7:29am UTC](https://community.zeek.org/t/zeek-performance-with-some-events-activated/5666/4 "2019-04-19T07:29:21Z")
Hi Jon,    thanks. This is what I thought. We need to evaluate realtime traffic, not offline traffic. I'll think about which way is better for us. Mauro -----Messaggio originale----- ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:46pm UTC](https://community.zeek.org/t/zeek-performance-with-some-events-activated/5666/5 "2022-05-06T15:46:26Z")