7.16.3 ftp
functions
The standard ftp
script provides one function for external use:
is_ftp_data_conn (c: connection): bool
- Returns true if the given connection matches one we're expecting
as the data connection half of an FTP session. Note: This function is
not idempotent: if the connection matches an expected one, then
Bro updates its state such that that connection is no longer expected.
It also logs a discrepancy if the connection appears to be usurping
another one that generated either a “
PORT
” or a “PASV
”
directive.
Also returns true if the source port is 20/tcp
and there's currently
an FTP session active between the originator and responder, in case for
some reason Bro's bookkeeping is inconsistent.