HI
I'm seeing ftp preprocessor alerts from traffic on port 2100 and I
can't see why.
From snort conf:
preprocessor ftp_telnet_protocol: ftp server default \
ports { 21 } \
def_max_param_len 100 \
ftp_cmds { USER PASS ACCT CWD CDUP SMNT \
QUIT REIN PORT PASV TYPE STRU MODE RETR STOR STOU APPE ALLO REST \
RNFR RNTO ABOR DELE RMD MKD PWD LIST NLST SITE SYST STAT HELP
NOOP } \
ftp_cmds { AUTH ADAT PROT PBSZ CONF ENC } \
ftp_cmds { FEAT OPTS } \
ftp_cmds { MDTM REST SIZE MLST MLSD EPSV } \
alt_max_param_len 0 { CDUP QUIT REIN PASV STOU ABOR PWD SYST NOOP } \
cmd_validity MODE < char ASBCZ > \
cmd_validity STRU < char FRP > \
cmd_validity ALLO < int [ char R int ] > \
cmd_validity TYPE < { char AE [ char NTC ] | char I | char L
[ number ] } > \
cmd_validity PORT < host_port >
Which clearly says port 21.
Yet I see:
META
SID CID TimeStamp Signature Sig ID
1 5823276 2008-07-08 13:53:23 ftp_pp: Invalid FTP command 2
Sensor Hostname Sensor Interface
monitor-itss.insec.auckland.ac.nz ITSS sector switch
IP
Source Address Dest Address Ver Hdr Len TOS length ID flags
offset TTL
chksum
130.216.138.211 130.216.123.59 4 5 0 172 16279 2
0 127 45045
Resolved Source Resolved Dest
macula.opt.auckland.ac.nz tamexam8.opt.auckland.ac.nz
TCP
Source Port Dest Port Seq Ack Offset Reserved Flags
Window Checksum
Urgent Ptr
1158 2100 2491263236 988172587 5 0 24 65211
58408 0
Options
None
Flags
RB 1 RB 0 URG ACK PSH RST SYN FIN
-------------------------------------------------------------------------
Sponsored by: SourceForge.net Community Choice Awards: VOTE NOW!
Studies have shown that voting for your favorite open source project,
along with a healthy diet, reduces your potential for chronic lameness
and boredom. Vote Now at http://www.sourceforge.net/community/cca08
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
