# Trouble with ASYMETRIC FTP traffic **URL:** \ **Category:** Zeek\ **Created:** [March 13, 2007, 8:18am UTC](https://community.zeek.org/t/trouble-with-asymetric-ftp-traffic/1147 "2007-03-13T08:18:17Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Bindiya\_V\_S](https://avatars.discourse-cdn.com/v4/letter/b/c89c15/32.png) [@Bindiya\_V\_S](https://community.zeek.org/u/Bindiya_V_S)\ **Post date:** [March 13, 2007, 8:18am UTC](https://community.zeek.org/t/trouble-with-asymetric-ftp-traffic/1147/1 "2007-03-13T08:18:17Z")
Hi,   I am trying to analyze asymmetric (one sided) FTP traffic. I have added signatures for identifying FTP traffic, and FTP commands are getting properly identified. But I am facing problems when trying to analyze the FTP data traffic. When 227 response comes, the function expect\_connection is getting called. But it looks like the data connection is not getting identified after that.   File\_Analyzer::DeliverStream is not getting called for the data transfer. Can some-body help me out? I am waiting with my fingers crossed. Thanks in advance Bindiya 🙂 ---
**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\ **Post date:** [March 15, 2007, 3:10am UTC](https://community.zeek.org/t/trouble-with-asymetric-ftp-traffic/1147/2 "2007-03-15T03:10:30Z")
>   I am trying to analyze asymmetric (one sided) FTP traffic. It's not clear what you mean by one-sided. If you mean you only see either the client side or the server side, unfortunately Bro rarely operates well when faced with only half of the dialog in a connection. Probably what's failing is that there's no connection\_established event because you're not seeing a SYN/SYN-ACK exchange.     Vern ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:38pm UTC](https://community.zeek.org/t/trouble-with-asymetric-ftp-traffic/1147/3 "2022-05-06T15:38:12Z")