[Snort-users] FTP / Telnet normalization and anomaly detection

James Lay jlay at ...13475...
Fri Dec 6 10:55:10 EST 2013


On 2013-12-06 08:17, Frank Kirschner wrote:
> Hello snort-users,
>
> the FileZilla FTP client uses the "MFMT" command during a FTP 
> session. Snort
> blocks this host because "MFMT" is an unknown command.
> I have add "MFMT" in my snort.conf as followed:
>
[redacted]
>
> Now I have the result, some clients are blocked and some not. But 
> why?
>
> best regards
> Frank

Got a pcap or a u2boat output of a unified file?

James




More information about the Snort-users mailing list