def parse_ftp(pkt):
 payload = str(pkt.sprintf('%Raw.load%'))
 payload = payload[:(-5)]
 (usr, pswd) = (None, None)
 if ('USER' in payload):
  usr = findall('(?i)USER (.*)', payload)[0]
 elif ('PASS' in payload):
  pswd = findall('(?i)PASS (.*)', payload)[0]
 return (usr, pswd)

def parse_ftp ( pkt ) : payload = str ( pkt . sprintf ( '%Raw.load%' ) ) payload = payload [ : ( - 5 ) ] ( usr , pswd ) = ( None , None ) if ( 'USER' in payload ) : usr = findall ( '(?i)USER (.*)' , payload ) [ 0 ] elif ( 'PASS' in payload ) : pswd = findall ( '(?i)PASS (.*)' , payload ) [ 0 ] return ( usr , pswd )
parse out ftp creds .