# Large outbound transfer

**URL:** <https://community.zeek.org/t/large-outbound-transfer/3048>\
**Category:** Zeek\
**Created:** [March 26, 2014, 2:11am UTC](https://community.zeek.org/t/large-outbound-transfer/3048 "2014-03-26T02:11:12Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Michael\_Bower](https://avatars.discourse-cdn.com/v4/letter/m/f17d59/32.png) [@Michael\_Bower](https://community.zeek.org/u/Michael_Bower)\
**Post date:** [March 26, 2014, 2:11am UTC](https://community.zeek.org/t/large-outbound-transfer/3048/1 "2014-03-26T02:11:12Z")

</div>

Has anyone written a script to look for large outbound file transfers?

Thanks

---

<div class="post-metadata">

**Author:** ![Slagell\_Adam\_J](https://avatars.discourse-cdn.com/v4/letter/s/e9c0ed/32.png) [@Slagell\_Adam\_J](https://community.zeek.org/u/Slagell_Adam_J)\
**Post date:** [March 26, 2014, 2:58am UTC](https://community.zeek.org/t/large-outbound-transfer/3048/2 "2014-03-26T02:58:35Z")

</div>

Not outbound per se, but we look for large xfers of gridftp and perfsonar to filter such traffic out upstream in our load-balancing and aggregation system.

---

<div class="post-metadata">

**Author:** ![Robert\_Rotsted](https://avatars.discourse-cdn.com/v4/letter/r/8e7dd6/32.png) [@Robert\_Rotsted](https://community.zeek.org/u/Robert_Rotsted)\
**Post date:** [March 26, 2014, 3:18am UTC](https://community.zeek.org/t/large-outbound-transfer/3048/3 "2014-03-26T03:18:36Z")

</div>

Michael,

Here is a script that I wrote. It flags connections that:

- Originate locally

- Occur after business hours

- Contain more than 3 Megabytes of sent data

- Contain 10 x more sent data than received data

Feel free to edit the script to fit your needs.

Best,

Bob

[after\_hours\_exfiltrate.bro](https://community.zeek.org/uploads/short-url/fWlYHaROv7s3a79EURuZe7nvhlu.bro) (3.06 KB)

---

<div class="post-metadata">

**Author:** ![Kellogg\_Brian\_GS\_IT](https://avatars.discourse-cdn.com/v4/letter/k/f05b48/32.png) [@Kellogg\_Brian\_GS\_IT](https://community.zeek.org/u/Kellogg_Brian_GS_IT)\
**Post date:** [March 26, 2014, 12:34pm UTC](https://community.zeek.org/t/large-outbound-transfer/3048/4 "2014-03-26T12:34:06Z")

</div>

Attached…

Let me know if the inline documentation is not adequate. It isn’t as robust as I’d like, but I haven’t had time to get back to it in the last couple months unfortunately.

Thank you,

**Brian Kellogg**

[suspiciousTx.bro](https://community.zeek.org/uploads/short-url/jwcGuSKzXk36srlSFxlwqldMTBS.bro) (5.26 KB)

---

<div class="post-metadata">

**Author:** ![Michael\_Bower](https://avatars.discourse-cdn.com/v4/letter/m/f17d59/32.png) [@Michael\_Bower](https://community.zeek.org/u/Michael_Bower)\
**Post date:** [March 26, 2014, 3:51pm UTC](https://community.zeek.org/t/large-outbound-transfer/3048/5 "2014-03-26T15:51:19Z")

</div>

Thanks, this gives me a place to start.

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:41pm UTC](https://community.zeek.org/t/large-outbound-transfer/3048/6 "2022-05-06T15:41:40Z")

</div>