base/bif/plugins/Zeek_FTP.events.bif.zeek

GLOBAL
Namespace:

GLOBAL

Summary

Events

ftp_reply: event

Generated for server-side FTP replies.

ftp_request: event

Generated for client-side FTP commands.

ftp_starttls: event

Generated if an FTP connection switched to TLS using AUTH TLS.

Detailed Interface

Events

ftp_reply
Type:

event (c: connection, code: count, msg: string, cont_resp: bool)

Generated for server-side FTP replies.

See Wikipedia for more information about the FTP protocol.

Parameters:

  • c – The connection.

  • code – The numerical response code the server responded with.

  • msg – The textual message of the response.

  • cont_resp – True if the reply line is tagged as being continued to the next line. If so, further events will be raised and a handler may want to reassemble the pieces before processing the response any further.

See also: ftp_request, fmt_ftp_port, parse_eftp_port, parse_ftp_epsv, parse_ftp_pasv, parse_ftp_port

ftp_request
Type:

event (c: connection, command: string, arg: string)

Generated for client-side FTP commands.

See Wikipedia for more information about the FTP protocol.

Parameters:

  • c – The connection.

  • command – The FTP command issued by the client (without any arguments).

  • arg – The arguments going with the command.

See also: ftp_reply, fmt_ftp_port, parse_eftp_port, parse_ftp_epsv, parse_ftp_pasv, parse_ftp_port

ftp_starttls
Type:

event (c: connection)

Generated if an FTP connection switched to TLS using AUTH TLS. After this event no more FTP events will be raised for the connection. See the SSL analyzer for related SSL events, which will now be generated.

Parameters:

c – The connection.