up information, etc.  These checks are not done
if the given username is known to not exist for the server, in order to
not tie up system resources needlessly.  However, this does mean that more
work is done when handling &quot;good&quot; users than when handling
&quot;bad&quot; users.  This difference can be detected in the time it takes
for <code>proftpd</code> to send a response to the <code>USER</code> and
<code>PASS</code> commands.  This means it is possible for an attacker
to look for these statistic