# Telnet.log Implementation

**URL:** <https://community.zeek.org/t/telnet-log-implementation/6283>\
**Category:** Zeek\
**Created:** [December 23, 2020, 8:23pm UTC](https://community.zeek.org/t/telnet-log-implementation/6283 "2020-12-23T20:23:08Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![zeinabha36.zh](https://avatars.discourse-cdn.com/v4/letter/z/f08c70/32.png) [@zeinabha36.zh](https://community.zeek.org/u/zeinabha36.zh)\
**Post date:** [December 23, 2020, 8:23pm UTC](https://community.zeek.org/t/telnet-log-implementation/6283/1 "2020-12-23T20:23:08Z")

</div>

Hello Everyone,

I'm new to Zeek here and still learning the ropes. When searching through the protocols I didn't find telnet capture implementation in Zeek scripts.  
Then going through the docs I found there is a login\_plugin that has defined functions/events that can be used with telnet.

Can somebody help me on how i can use them to write a telnet capture script ? or if there is a simple ready script that I can start with.

Thanks in advance,

---

<div class="post-metadata">

**Author:** ![Patrick\_Kelley](https://avatars.discourse-cdn.com/v4/letter/p/a87d85/32.png) [@Patrick\_Kelley](https://community.zeek.org/u/Patrick_Kelley)\
**Post date:** [December 23, 2020, 11:30pm UTC](https://community.zeek.org/t/telnet-log-implementation/6283/2 "2020-12-23T23:30:46Z")

</div>

Here you go. Aaron and I threw this together a few years ago.

Maybe this will help you.

Warning… The telnet protocol is a bit grimmy and has plenty of sharp edges.

## TELNET Protocol Analyzer

## Developed by Aaron Eppert and Patrick Kelley

module TELNET;

export {  
redef enum Log::ID += { LOG };  
const default\_capture\_password = F &redef;  
type Info: record {

## Timestamp for when the event happened.

ts: time &log;

## Unique ID for the connection.

uid: string &log;

## The connection’s 4-tuple of endpoint addresses/ports.

id: conn\_id &log &optional;

## Telnet Session Behaviors

display: string &log &optional;  
user: string &log &optional;  
client\_user: string &log &optional;  
password: string &log &optional;  
line: string &log &optional;  
};

## Event that can be handled to access the telnet record as it is sent on

## to the logging framework.

global log\_telnet: event(rec: Info);  
}

redef record connection += {  
telnet: Info &optional;  
};

const ports = { 23/tcp };  
redef likely\_server\_ports += { ports };

event zeek\_init() &priority=5  
{  
Log::create\_stream(TELNET::LOG, [$columns=TELNET::Info, $ev=log\_telnet, $path=“telnet”]);  
Analyzer::register\_for\_ports(Analyzer::ANALYZER\_TELNET, ports);  
}

event login\_display(c: connection, display: string)  
{  
local rec: TELNET::Info = [$ts=network\_time(), $id=c$id, $uid=c$uid, $display=display];  
c$telnet = rec;  
Log::write(TELNET::LOG, rec);  
}

event login\_failure(c: connection, user: string, client\_user: string, password: string, line: string)  
{  
local login\_failure\_rec: TELNET::Info = [$ts=network\_time(), $id=c$id,$uid=c$uid, $user=user, $client\_user=client\_user, $password=password, $line=line];  
c$telnet = login\_failure\_rec;  
Log::write(TELNET::LOG, login\_failure\_rec);  
}

event login\_success(c: connection, user: string, client\_user: string, password: string, line: string)  
{  
local login\_success\_rec: TELNET::Info = [$ts=network\_time(), $id=c$id,$uid=c$uid, $user=user, $client\_user=client\_user, $password=password, $line=line];  
c$telnet = login\_success\_rec;  
Log::write(TELNET::LOG, login\_success\_rec);  
}

event login\_input\_line(c: connection, line: string)  
{  
local login\_input\_line\_rec: TELNET::Info = [$ts=network\_time(), $id=c$id,$uid=c$uid, $line=line];  
c$telnet = login\_input\_line\_rec;  
Log::write(TELNET::LOG, login\_input\_line\_rec);  
}

event login\_output\_line(c: connection, line: string)  
{  
local login\_output\_line\_rec: TELNET::Info = [$ts=network\_time(), $id=c$id,$uid=c$uid, $line=line];  
c$telnet = login\_output\_line\_rec;  
Log::write(TELNET::LOG, login\_output\_line\_rec);  
}

---

<div class="post-metadata">

**Author:** ![zeinabha36.zh](https://avatars.discourse-cdn.com/v4/letter/z/f08c70/32.png) [@zeinabha36.zh](https://community.zeek.org/u/zeinabha36.zh)\
**Post date:** [December 24, 2020, 7:01am UTC](https://community.zeek.org/t/telnet-log-implementation/6283/3 "2020-12-24T07:01:06Z")

</div>

Thanks Patrick , I'll give it a try then

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:47pm UTC](https://community.zeek.org/t/telnet-log-implementation/6283/4 "2022-05-06T15:47:32Z")

</div>