[Bro] [bro] FTP User Name

[Tim Desrochers]

Where does the username from FTP logs get derived from?

I have a use case where I see FTP traffic to a destination but my AD is
reporting the user originating the traffic as one name but the user field
of the FTP log shows a different name.

Why would this be?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20160210/29878159/attachment.html