O'Reilly logo

Mastering Windows Network Forensics and Investigation, 2nd Edition by Scott Pearson, Ryan Johnson, Steve Bunting, Steven Anson

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

Parsing FTP Logs

FTP stands for File Transfer Protocol, and an FTP server sends and receives files over a TCP/IP network using FTP. These servers, just like their web server counterparts, keep detailed logs. In fact, if you understand web logs, you will be pleased to know that the Windows FTP server uses the same default log format, which is W3C. When examining FTP logs, you can primarily use the fields shown previously in Table 11-1, but be aware that FTP logs do not record the following fields:

  • cs-uri-query
  • cs-host
  • cs(User-Agent)
  • cs(Cookie)
  • cs(Referrer)

Although both FTP and HTTP use the same default logging format, the sc-status codes differ for the two protocols. Table 11-4 lists the status codes for FTP.

Table 11-4: FTP sc-status Codes ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required