mirror of
https://github.com/zeek/zeek.git
synced 2025-10-14 12:38:20 +00:00
FileAnalysis: replace script-layer FTP file analysis.
The notable difference here is that ftp.log now logs by default the PORT, PASV, EPRT, EPSV commands as well as a separate line for ftp-data channels in which file extraction was requested. This difference isn't a direct result of now doing the file extraction through the file analysis framework, it's just because I noticed even the old way of tracking extracted-file name didn't work right and this was the way I came up with so that a locally extracted file can be associated with a data channel and then that data channel associated with a control channel.
This commit is contained in:
parent
621fe51c82
commit
7e895a3a2f
13 changed files with 227 additions and 67 deletions
|
@ -43,9 +43,6 @@ export {
|
|||
};
|
||||
|
||||
redef record State += {
|
||||
## Store a count of the number of files that have been transferred in
|
||||
## a conversation to create unique file names on disk.
|
||||
num_extracted_files: count &default=0;
|
||||
## Track the number of MIME encoded files transferred during a session.
|
||||
mime_level: count &default=0;
|
||||
};
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue