So let's go ahead and just write this to file and then to invoke it,
we're going to use this http_download.pcap,
and let's just invoke it using the bare bones Zeek scripting.
And it looks like we have an error that we need to go ahead and look at,
so let's go ahead and nano that again, and it looks like it's line 42.
And one thing about the Zeek scripting framework is it is
very meticulous about its functions, and the different variables,
and how they interact.
So the capital letters not being there for the log is what did it.
So we run that, and now we have the conn.log and the weird.log.
But notice how it didn't create our download log,
so that means that there's something with the script
that's not quite working as expected.
And as you can see,
we actually needed the HTTP information because it's also
being passed into the connection record as well to help
fill in additional information.
And so now that we were able to run it, we see that we have the downloads.log.
And as you can see, we have all of the fields that we pass to it,
as well as the converted size in megabytes.
It's only a 52‑MB file.
The conversion was automatically done and passed over to
the logging framework to log here, so it works as expected.
And then also, with the HTTP Analyzer,
we can look at the http log that's generated as well and see a little
bit additional information about the status codes,
and the messages, and the actual response body lengths,
and stuff like that.
So we can use this information as well in our script if we wanted to.
And then finally,
the last log that I wanted to show you about that is the notice.log.
And as you can see,
our alert itself was passed over to the notice framework, and we have the
note with the high traffic download that we designated in there, as well as
the text inside of the message. So it said, Large HTTP Transfer Detected!!!
This is an insecure port as well!!! And so that's it for our simple script to
detect large HTTP transfers.