It looks like Bro is logging part of the file name as the file size in some cases.
I’m using Bro 2.3.2 on Cent 6.6 x64, libpcap 1.4.0.
What I’m seeing is that we have some regular FTP activity that looks like this:
command arg file_size
RETR ftp://{ip}/DIR/SUBDIR\ARCHIVE/9254493514002F.TIF 9254493514002
RETR ftp://{ip}/DIR/SUBDIR\ARCHIVE/9254493514006R.TIF 9254493514006
RETR ftp://{ip}/DIR/SUBDIR\ARCHIVE/9254493514043F.TIF 9254493514043
My google fu might be off, but II’m going to be rolling out 2.4 but I can’t do it right away.
Michael