Re: log ftp servers in our network

[piotr.bulczak () pl abb com]

Magnus <marix () strul net> wrote:
> At 19:15 2002-04-14 -0700, you wrote:
> > On Sun, 14 Apr 2002, Banai Zoltan wrote:
> >
> > > Short:
> > > Is it possible to log that there is ftp server in our network on
_any_
> > port?
[...]
> log tcp any any -> $HOME_NET !110       -> (msg:"FTP login USER";
> content:"USER "; )
> log tcp any any -> $HOME_NET !110       -> (msg:"FTP login PASS";
> content:"PASS "; )
> Should be able to dectect incoming ftp logins..
> !110 to disregard al that nice email popping...
[...]

USER and PASS patterns may generate quite a lot of false events. Maybe some
more FTP specific pattern would be better like:

log tcp $HOME_NET any -> any any (msg:"FTP binary transfer";
content:"Opening BINARY mode data connection"; )
log tcp $HOME_NET any -> any any (msg:"FTP ascii transfer";
content:"Opening ASCII mode data connection"; )
etc...

The number of falses should be lower however the patterns may vary
depending on FTP server used.

Regards,
Piotr



_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users