[Snort-users] FTP / Telnet normalization and anomaly detection
jlay at ...13475...
Fri Dec 6 10:55:10 EST 2013
On 2013-12-06 08:17, Frank Kirschner wrote:
> Hello snort-users,
> the FileZilla FTP client uses the "MFMT" command during a FTP
> session. Snort
> blocks this host because "MFMT" is an unknown command.
> I have add "MFMT" in my snort.conf as followed:
> Now I have the result, some clients are blocked and some not. But
> best regards
Got a pcap or a u2boat output of a unified file?
More information about the Snort-users