# Large outbound transfer

**URL:** <https://community.zeek.org/t/large-outbound-transfer/3049>\
**Category:** Zeek\
**Created:** [March 26, 2014, 3:31am UTC](https://community.zeek.org/t/large-outbound-transfer/3049 "2014-03-26T03:31:33Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![scott\_mcallester](https://avatars.discourse-cdn.com/v4/letter/s/d9b06d/32.png) [@scott\_mcallester](https://community.zeek.org/u/scott_mcallester)\
**Post date:** [March 26, 2014, 3:31am UTC](https://community.zeek.org/t/large-outbound-transfer/3049/1 "2014-03-26T03:31:33Z")

</div>

```auto
I have, but it uses the connection_state_remove event, and the more I think about it, the more I think it wouldn't work.
If someone manages to gain access to our file server, zips up 10-20gb of our files and starts transferring this out, I dont think this event would fire until the connection closes, which would be too late, but here it is anyway: 

```

@load base/frameworks/notice

module DataExfiltration;

export {  
redef enum Notice::Type += {data\_exfiltration\_100mb};  
}

event connection\_state\_remove(c: connection)  
{  
if (c$orig$num\_bytes\_ip \> 102400000 && c$orig$num\_pkts \> 1000) {  
#test for internal to external direction ; &n bsp;  
if(Site::is\_local\_addr(c$id$orig\_h)){  
if( ! Site::is\_local\_addr(c$id$resp\_h)){  
NOTICE([$note=data\_exfiltration\_100mb,  
$msg="\> 100mb of data sent out in a single connection",  
$conn=c]);  
&n bsp; ;  
}  
}  
}  
}

And this in local.bro:

@load DataExfiltration  
hook Notice::policy(n: Notice::Info) {  
if ( n$note == DataExfiltration::data\_exfiltration\_100mb )  
add n$actions[Notice::ACTION\_EMAIL];  
n$email\_body\_sections[|n$email\_body\_sections|] = fmt(“Service: %s\nData sent: %s\nData received: %s”, join\_string\_set(n$conn$service, “,”), n$conn$orig$size, n$conn$resp$size );  
}

---

<div class="post-metadata">

**Author:** ![Michael\_Bower](https://avatars.discourse-cdn.com/v4/letter/m/f17d59/32.png) [@Michael\_Bower](https://community.zeek.org/u/Michael_Bower)\
**Post date:** [March 26, 2014, 4:04am UTC](https://community.zeek.org/t/large-outbound-transfer/3049/2 "2014-03-26T04:04:34Z")

</div>

These are helpful, thanks!

Mike

---

<div class="post-metadata">

**Author:** ![Siwek\_Jon](https://avatars.discourse-cdn.com/v4/letter/s/90db22/32.png) [@Siwek\_Jon](https://community.zeek.org/u/Siwek_Jon)\
**Post date:** [March 26, 2014, 3:35pm UTC](https://community.zeek.org/t/large-outbound-transfer/3049/3 "2014-03-26T15:35:29Z")

</div>

If you need to take actions based on conditions of an ongoing connection, you can possibly use the ConnPolling [1] module to do it. An example usage of it is a gridftp detection script that ships w/ Bro [2].

- Jon

[1] [http://bro.org/sphinx/scripts/base/protocols/conn/polling.html](http://bro.org/sphinx/scripts/base/protocols/conn/polling.html)  
[2] [http://bro.org/sphinx/scripts/base/protocols/ftp/gridftp.html](http://bro.org/sphinx/scripts/base/protocols/ftp/gridftp.html)

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:41pm UTC](https://community.zeek.org/t/large-outbound-transfer/3049/4 "2022-05-06T15:41:40Z")

</div>