# $Id: tftp.bro,v 1.6 2003/08/31 00:40:21 vern Exp $

# Very simplistic - doesn't pick up the replies.

@load alert

redef enum Alert += {
	OutboundTFTP,		# outbound TFTP seen
};

redef capture_filters += { ["tftp"] = "udp port 69" };

@load udp
@load site

global tftp_alert_count: table[addr] of count &default = 0;

event udp_request(u: connection)
	{
	if ( u$id$resp_p == 69/udp && u$id$orig_p >= 1024/udp )
		{
		local src = u$id$orig_h;

		if ( is_local_addr(src) && ++tftp_alert_count[src] == 1 )
			ALERT([$alert=OutboundTFTP, $conn=u,
				$msg=fmt("outbound TFTP: %s -> %s", src, u$id$resp_h)]);
		}
	}
