[Snort-users] FTP invalid MODE

Matt Kettler mkettler at ...4108...
Thu Jul 25 10:47:03 EDT 2002


There's nothing invalid about MODE B. Thats the RFC compliant way of 
requesting block mode transfer.

http://www.wu-ftpd.org/rfc/rfc0959.txt

       TRANSFER MODE (MODE)

          The argument is a single TELNET character code specifying the
          data transfer modes described in the Section on Transmission
          Modes.  The following codes are assigned for transfer modes:

             S - Stream
             B - Block
             C - Compressed

Binary transfers are a type, not a mode, and in RFC language, its Image, 
not binary :)

So it sounds like your FTP server only supports stream mode, which is OK 
since support for block and compressed mode is optional.

At 11:38 AM 7/25/2002 -0400, larosa, vjay wrote:
>Hello,
>
>Periodically I recieve FTP invalid MODE events. When I look at the packet
>payload I see this.
>
>MODE B
>
>Any body know what is causing this? I searched around on google but didn't
>have any luck. I thought
>maybe it had something to do with a shortcut meaning use binary mode, but
>obviosly my FTP servers
>don't like that.
>
>Thanks!
>
>vjl
>
>
>
>V.Jay LaRosa                           EMC Corporation
>Information Security                  171 South Street
>(508)249-3355 office                  Hopkinton, MA 01748
>(508)498-5575 cell                     www.emc.com
>(888-799-9750 pager                  larosa_vjay at ...3331...
>(508)497-8082 fax
>
>
>
>-------------------------------------------------------
>This sf.net email is sponsored by: Jabber - The world's fastest growing
>real-time communications platform! Don't just IM. Build it in!
>http://www.jabber.com/osdn/xim
>_______________________________________________
>Snort-users mailing list
>Snort-users at lists.sourceforge.net
>Go to this URL to change user options or unsubscribe:
>https://lists.sourceforge.net/lists/listinfo/snort-users
>Snort-users list archive:
>http://www.geocrawler.com/redir-sf.php3?list=snort-users





More information about the Snort-users mailing list