zeek/scripts
Arne Welzel 31b548babc ftp: Reset fuid after logging
A user reported being confused about the fuid association of subsequent
FTP commands when a data transfer has completed. It seems reasonable to
unset fuid upon logging a FTP command which had a fuid.

The current behavior results in the PORT or PASV commands after a RETR or STOR
to have the fuid of the prior file transfer. Similarly, any CWD or DEL commands
following a file transfer will unnecessarily be logged with the fuid of the
prior file transfer.

This tickles the baselines for the private testing PCAP a lot, primarily
because there data connections in that pcap are never established properly.
E.g, the fuids FzDzid1Dxm9srVKHXf and FEfYX73q5C6GEQZXX9 have been re-used
for multiple commands.

This may look like we're losing information, but the fuids vanishing
in the normal btests belong to a LIST command that isn't logged by
default into ftp.log. If it was, the fuid would be attached to it.
2024-02-21 12:41:32 +01:00
..
base ftp: Reset fuid after logging 2024-02-21 12:41:32 +01:00
policy Netcontrol: add rule_added_policy 2024-02-05 18:52:27 +00:00
site telemetry: Disable metrics centralization by default 2023-06-21 20:13:55 +02:00
spicy improve search-ability in zeek.spicy 2023-12-14 16:24:32 -05:00
zeekygen zeekygen: Disable zeek_init() handlers causing error output 2023-10-11 15:18:33 +02:00
CMakeLists.txt Use the same rules as cmake submodule to reformat Zeek 2023-05-09 08:31:43 -07:00
test-all-policy.zeek telemetry: Disable metrics centralization by default 2023-06-21 20:13:55 +02:00