diff --git a/scripts/base/protocols/ftp/gridftp.bro b/scripts/base/protocols/ftp/gridftp.bro index 68be66d53a..5090eebb3d 100644 --- a/scripts/base/protocols/ftp/gridftp.bro +++ b/scripts/base/protocols/ftp/gridftp.bro @@ -74,6 +74,8 @@ event ConnThreshold::bytes_threshold_crossed(c: connection, threshold: count, is { if ( threshold < size_threshold || "gridftp-data" in c$service || c$duration > max_time ) return; + if ( ! data_channel_initial_criteria(c) ) + return; add c$service["gridftp-data"]; event GridFTP::data_channel_detected(c);