[Bro] [bro] FTP User Name

[Tim Desrochers]

I understand now. I am checking kerberos logs now to determine the user.

Thank you for responses.
On Feb 10, 2016 11:19 AM, "Seth Hall" <seth at icir.org> wrote:

>
> > On Feb 10, 2016, at 10:58 AM, Tim Desrochers <tgdesrochers at gmail.com>
> wrote:
> >
> > So I guess my question should be, does bro pull the name from the the
> FTP session or does it try to pull info from something like the devices log
> to determine the user of the IP address who uploaded the file?
>
> From the FTP session as Vlad indicated.
>
>   .Seth
>
> --
> Seth Hall
> International Computer Science Institute
> (Bro) because everyone has a network
> http://www.bro.org/
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20160210/d8b85893/attachment-0001.html