5 commits

Author	SHA1	Message	Date
Arne Welzel	31b548babc	ftp: Reset fuid after logging ... A user reported being confused about the fuid association of subsequent FTP commands when a data transfer has completed. It seems reasonable to unset fuid upon logging a FTP command which had a fuid. The current behavior results in the PORT or PASV commands after a RETR or STOR to have the fuid of the prior file transfer. Similarly, any CWD or DEL commands following a file transfer will unnecessarily be logged with the fuid of the prior file transfer. This tickles the baselines for the private testing PCAP a lot, primarily because there data connections in that pcap are never established properly. E.g, the fuids FzDzid1Dxm9srVKHXf and FEfYX73q5C6GEQZXX9 have been re-used for multiple commands. This may look like we're losing information, but the fuids vanishing in the normal btests belong to a LIST command that isn't logged by default into ftp.log. If it was, the fuid would be attached to it.	2024-02-21 12:41:32 +01:00
Arne Welzel	8c5896a74d	scripts: Migrate table iteration to blank identifiers ... No obvious hot-cases. Maybe the describe_file() ones or the intel ones if/when there are hot intel hits.	2022-10-24 10:36:09 +02:00
Tim Wojtulewicz	a6378531db	Remove trailing whitespace from script files	2021-10-20 09:57:09 -07:00
Jon Siwek	a994be9eeb	Merge remote-tracking branch 'origin/topic/seth/zeek_init' ... * origin/topic/seth/zeek_init: Some more testing fixes. Update docs and tests for bro_(init|done) -> zeek_(init|done) Implement the zeek_init handler.	2019-04-19 11:24:29 -07:00
Daniel Thayer	18bd74454b	Rename all scripts to have ".zeek" file extension	2019-04-11 21:12:40 -05:00

Renamed from scripts/base/protocols/ftp/files.bro (Browse further)