[Zeek] Extracting packets from a particular connection

[Raghunath, Ananditha - 0557 - MITLL]

Hi,
I was hoping to understand how Zeek aggregates packets by connection. Is there any documentation that summarizes the approach? Is there a way to extract all the packets that correspond to a particular connection?


Thank you,


Ananditha Raghunath - 0557
Assistant Staff
Cyber Operations and  Analysis Technology
MIT Lincoln Laboratory
ananditha.raghunath at ll.mit.edu | 781-981-9035
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/zeek/attachments/20190424/8d0b536a/attachment-0001.html