FTP sessions show no data
Originally Published: 2015-03-23
Last Modified: 2023-09-22
Article Number
000060081
Applies To
Security analytics 10.X series
Issue
Some FTP sessions do not show any data.
Cause

The session in which commands are entered and their results displayed is the 'command' session.

The sessions in which files and directory listings are transferred are the 'data' sessions.

A command session contains no files, ever. However, it will contain file names. A data session will contain no file names, nor anything else other than the constituent bytes of files themselves (note that files do not contain their own names).

For example, an FTP session between A and B:

User at A opens an FTP session to server at B - this is the command session. The user logs in, and issues the command "get helloworld.exe". A separate, distinct session opens up between A and B in which the bytes consisting of the requested file are transferred - this is the data session. The user then logs out.

There are two sessions:

Session 1
service: 21
action: login
username: userA
password: password
action: get
filename: helloworld.exe
extension: exe
link: (see below)

Session 2
fingerprint: windows_executable

Session 1, the command session, contains the filename. Session 2, the data session, contains the file.

Resolution
To see the file that the command session is pointing to you would need to use the thick client investigator.  The SA UI has no way of correlating the command session to the data session.  Thick client has a correlate button when you're looking at a command session.  This way you can easily extract the data session.


A feature request has been added for this