# How does Bro capture the traffic of ftp data connection ?

**URL:** <https://community.zeek.org/t/how-does-bro-capture-the-traffic-of-ftp-data-connection/1151>\
**Category:** Zeek\
**Created:** [March 15, 2007, 4:01am UTC](https://community.zeek.org/t/how-does-bro-capture-the-traffic-of-ftp-data-connection/1151 "2007-03-15T04:01:44Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![user18](https://avatars.discourse-cdn.com/v4/letter/u/6a8cbe/32.png) [@user18](https://community.zeek.org/u/user18)\
**Post date:** [March 15, 2007, 4:01am UTC](https://community.zeek.org/t/how-does-bro-capture-the-traffic-of-ftp-data-connection/1151/1 "2007-03-15T04:01:44Z")

</div>

```auto
if i only load the ftp analyzer-ftp.bro,and the following line
     redef capture_filters += { ["ftp"] = "port ftp" };
will guide bro to capture the traffic from and to port 21,and the event
handler of ftp_request and ftp_reply,doesn't include statements to capture
the port traffic after finding the command "port" or "pasv",and just add a
entry in the session table,but if libpcap can't capture corresponding
packet,the added entry doesn't work!
    So how does it dynamically add the filter string to capture the
temporary traffic?
    Anyone can help me ? 3x

```

---

<div class="post-metadata">

**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\
**Post date:** [March 15, 2007, 7:09pm UTC](https://community.zeek.org/t/how-does-bro-capture-the-traffic-of-ftp-data-connection/1151/2 "2007-03-15T19:09:57Z")

</div>

It doesn't. Dynamically changing the BPF filter is too expensive as  
it would need to be recompiled every time (and the filter would  
quickly get huge).

If you want Bro to analyze the content of ftp-data sessions, you  
need to manually override the pcap filter to include all packets,  
e.g., by running with "-f tcp".

Robin

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:38pm UTC](https://community.zeek.org/t/how-does-bro-capture-the-traffic-of-ftp-data-connection/1151/3 "2022-05-06T15:38:13Z")

</div>