# FTP Filenames used for file size in some cases?

**URL:** <https://community.zeek.org/t/ftp-filenames-used-for-file-size-in-some-cases/3733>\
**Category:** Zeek\
**Created:** [July 27, 2015, 8:36pm UTC](https://community.zeek.org/t/ftp-filenames-used-for-file-size-in-some-cases/3733 "2015-07-27T20:36:13Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Michael\_Wenthold](https://avatars.discourse-cdn.com/v4/letter/m/13edae/32.png) [@Michael\_Wenthold](https://community.zeek.org/u/Michael_Wenthold)\
**Post date:** [July 27, 2015, 8:36pm UTC](https://community.zeek.org/t/ftp-filenames-used-for-file-size-in-some-cases/3733/1 "2015-07-27T20:36:13Z")

</div>

It looks like Bro is logging part of the file name as the file size in some cases.

I’m using Bro 2.3.2 on Cent 6.6 x64, libpcap 1.4.0.

What I’m seeing is that we have some regular FTP activity that looks like this:

command arg file\_size

RETR ftp://{ip}/DIR/SUBDIR\ARCHIVE/9254493514002F.TIF 9254493514002  
RETR ftp://{ip}/DIR/SUBDIR\ARCHIVE/9254493514006R.TIF 9254493514006  
RETR ftp://{ip}/DIR/SUBDIR\ARCHIVE/9254493514043F.TIF 9254493514043

My google fu might be off, but II’m going to be rolling out 2.4 but I can’t do it right away.

Michael

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:42pm UTC](https://community.zeek.org/t/ftp-filenames-used-for-file-size-in-some-cases/3733/2 "2022-05-06T15:42:54Z")

</div>