[Bro] [bro] FTP User Name

[Seth Hall]

> On Feb 10, 2016, at 10:58 AM, Tim Desrochers <tgdesrochers at gmail.com> wrote:
> 
> So I guess my question should be, does bro pull the name from the the FTP session or does it try to pull info from something like the devices log to determine the user of the IP address who uploaded the file?

>From the FTP session as Vlad indicated.

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro.org/