base/protocols/ftp/main.zeek¶
-
FTP
¶
The logging this script does is primarily focused on logging FTP commands along with metadata. For example, if files are transferred, the argument will take on the full path that the client is at along with the requested file name.
- Namespace
FTP
- Imports
base/frameworks/cluster, base/protocols/conn/removal-hooks.zeek, base/protocols/ftp/info.zeek, base/protocols/ftp/utils-commands.zeek, base/protocols/ftp/utils.zeek, base/utils/addrs.zeek, base/utils/numbers.zeek, base/utils/paths.zeek
Summary¶
Runtime Options¶
User IDs that can be considered “anonymous”. |
|
List of commands that should have their command/response pairs logged. |
Types¶
This record is to hold a parsed FTP reply code. |
Redefinitions¶
The FTP protocol logging stream identifier. |
|
Events¶
Event that can be handled to access the |
Hooks¶
FTP finalization hook. |
|
FTP data finalization hook. |
|
A default logging policy hook for the stream. |
Functions¶
Parse FTP reply codes into the three constituent single digit values. |
Detailed Interface¶
Runtime Options¶
- FTP::guest_ids¶
-
User IDs that can be considered “anonymous”.
- FTP::logged_commands¶
- Type
- Attributes
- Default
{ "ACCT", "DELE", "APPE", "RETR", "PORT", "STOR", "EPRT", "PASV", "STOU", "EPSV" }
List of commands that should have their command/response pairs logged.
Types¶
Events¶
- FTP::log_ftp¶
-
Event that can be handled to access the
FTP::Info
record as it is sent on to the logging framework.
Hooks¶
- FTP::finalize_ftp¶
- Type
FTP finalization hook. Remaining FTP info may get logged when it’s called.
- FTP::finalize_ftp_data¶
- Type
hook
(c:connection
) :bool
FTP data finalization hook. Expected FTP data channel state may get purged when called.
- FTP::log_policy¶
- Type
A default logging policy hook for the stream.
Functions¶
- FTP::parse_ftp_reply_code¶
- Type
function
(code:count
) :FTP::ReplyCode
Parse FTP reply codes into the three constituent single digit values.