[Zeek] ftp filesize

[Seth Hall]

File sizes for FTP are a bit tricky.  The scripts are just watching
for the server to indicate the file size in a reply message.  I'm not
sure if the file size is transmitted by the client when a file is
being uploaded, I'd have to refer to some pcaps.  If it is indicated
by the client then I think we could view that as a missing
implementation though.

  .Seth

On Wed, Feb 6, 2019 at 7:29 AM Downie, Bob <rdownie at mitre.org> wrote:
>
> Bro ftp log  only seems to record file_size for files that are pulled down from the interwebs. It does not record file size for files that are uploaded. Is this the expected behavior? We are running bro-2.5.3. Any help would be appreciated.
>
> Thanks,
>
> -Bob
>
> _______________________________________________
> Zeek mailing list
> zeek at zeek.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek



-- 
Seth Hall * Corelight, Inc * seth at corelight.com * www.corelight.com