# buglet in FTP processing for 1.E7Vo2Cjyt39.pcap in slice 9

**URL:** <https://community.zeek.org/t/buglet-in-ftp-processing-for-1-e7vo2cjyt39-pcap-in-slice-9/2136>\
**Category:** Development\
**Tags:** development\
**Created:** [December 1, 2011, 12:10am UTC](https://community.zeek.org/t/buglet-in-ftp-processing-for-1-e7vo2cjyt39-pcap-in-slice-9/2136 "2011-12-01T00:10:24Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\
**Post date:** [December 1, 2011, 12:10am UTC](https://community.zeek.org/t/buglet-in-ftp-processing-for-1-e7vo2cjyt39-pcap-in-slice-9/2136/1 "2011-12-01T00:10:24Z")

</div>

The FTP log file reports the size of the transferred items as 76 and 7 bytes,  
while in the dialog they're actually reported in KB (apparently):

&nbsp;&nbsp;150 Binary transfer started (76k).  
&nbsp;&nbsp;....  
&nbsp;&nbsp;150 Binary transfer started (7k).

I'm not sure whether these are worth worrying about, though. Presumably  
if the accompanying ftp-data connections were also in the trace, the  
sizes would come from those (?).

&nbsp;&nbsp;&nbsp;&nbsp;Vern

---

<div class="post-metadata">

**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\
**Post date:** [December 1, 2011, 4:16am UTC](https://community.zeek.org/t/buglet-in-ftp-processing-for-1-e7vo2cjyt39-pcap-in-slice-9/2136/2 "2011-12-01T04:16:43Z")

</div>

> &nbsp;&nbsp;150 Binary transfer started (7k).

Oops, I haven't seen FTP servers do that before. I'll fix it.

> I'm not sure whether these are worth worrying about, though. Presumably  
> if the accompanying ftp-data connections were also in the trace, the  
> sizes would come from those (?).

I don't think the ftp base scripts pull data from that currently. That would make sense though. 🙂 One problem with it is that in cluster deployments it's very common for the data connections to not be analyzed appropriately (it only works if 2-tuple load balancing is taking place).

&nbsp;&nbsp;.Seth

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:40pm UTC](https://community.zeek.org/t/buglet-in-ftp-processing-for-1-e7vo2cjyt39-pcap-in-slice-9/2136/3 "2022-05-06T15:40:02Z")

</div>