# @TEST-EXEC: bro -r $TRACES/globus-url-copy.trace %INPUT # @TEST-EXEC: btest-diff notice.log # @TEST-EXEC: btest-diff conn.log # @TEST-EXEC: btest-diff ssl.log @load base/protocols/ftp/gridftp module GridFTP; redef size_threshold = 2; redef enum Notice::Type += { Data_Channel }; event GridFTP::data_channel_detected(c: connection) { local msg = fmt("GridFTP data channel over threshold %d bytes", size_threshold); NOTICE([$note=Data_Channel, $msg=msg, $conn=c]); }