# FTP data connections

**URL:** <https://community.zeek.org/t/ftp-data-connections/1129>\
**Category:** Zeek\
**Created:** [February 20, 2007, 11:16am UTC](https://community.zeek.org/t/ftp-data-connections/1129 "2007-02-20T11:16:25Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Christian\_Novello](https://avatars.discourse-cdn.com/v4/letter/c/3e96dc/32.png) [@Christian\_Novello](https://community.zeek.org/u/Christian_Novello)\
**Post date:** [February 20, 2007, 11:16am UTC](https://community.zeek.org/t/ftp-data-connections/1129/1 "2007-02-20T11:16:25Z")

</div>

Hello,  
I'm using bro to analyze ftp sessions and I want identify ftp data connections.

If the ftp session is in active mode, in ftp log file there is any  
line that indicate a ftp data connection instead in connection log  
file there is.  
Instead in passive mode there are any lines both in ftp log file and  
connection log file.

Are there any istructions that must be enable to print information  
about data connections in ftp log file?

Thanks

Christian Novello

---

<div class="post-metadata">

**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\
**Post date:** [February 20, 2007, 6:02pm UTC](https://community.zeek.org/t/ftp-data-connections/1129/2 "2007-02-20T18:02:02Z")

</div>

> I'm using bro to analyze ftp sessions and I want identify ftp data connections.
> 
> If the ftp session is in active mode, in ftp log file there is any  
> line that indicate a ftp data connection instead in connection log  
> file there is.  
> Instead in passive mode there are any lines both in ftp log file and  
> connection log file.

I'm afraid I'm having difficulty understanding from the above exactly what  
you're asking. However, Bro's FTP analyzer (see policy/ftp.bro) treats  
passive and active FTP transfers the same in terms of identifying the  
corresponding connection as "ftp-data". See the calls in the script  
to expect\_connection().

> Are there any istructions that must be enable to print information  
> about data connections in ftp log file?

What information about the connections do you want? They're already  
present in terms of PASV/PORT directives.

&nbsp;&nbsp;&nbsp;&nbsp;Vern

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:38pm UTC](https://community.zeek.org/t/ftp-data-connections/1129/3 "2022-05-06T15:38:10Z")

</div>