How does Bro capture the traffic of ftp data connection ?

Zeek
1 
if i only load the ftp analyzer-ftp.bro,and the following line
     redef capture_filters += { ["ftp"] = "port ftp" };
will guide bro to capture the traffic from and to port 21,and the event
handler of ftp_request and ftp_reply,doesn't include statements to capture
the port traffic after finding the command "port" or "pasv",and just add a
entry in the session table,but if libpcap can't capture corresponding
packet,the added entry doesn't work!
    So how does it dynamically add the filter string to capture the
temporary traffic?
    Anyone can help me ? 3x
2

It doesn't. Dynamically changing the BPF filter is too expensive as
it would need to be recompiled every time (and the filter would
quickly get huge).

If you want Bro to analyze the content of ftp-data sessions, you
need to manually override the pcap filter to include all packets,
e.g., by running with "-f tcp".

Robin