Bro ftp log only seems to record file_size for files that are pulled down from the interwebs. It does not record file size for files that are uploaded. Is this the expected behavior? We are running bro-2.5.3. Any help would be appreciated.
Thanks,
-Bob
Hi Bob,
Files live in the file log. The uid from the ftp log leads to the file in the file log.
In the file log you can find the size of the file.
Regards,
Daniel
File sizes for FTP are a bit tricky. The scripts are just watching
for the server to indicate the file size in a reply message. I'm not
sure if the file size is transmitted by the client when a file is
being uploaded, I'd have to refer to some pcaps. If it is indicated
by the client then I think we could view that as a missing
implementation though.
.Seth
Fwiw, from the examples I have I don't see a size indication -- not in the STORs, nor in commands/responses surrounding it.
Best,
-C.