Observing POP3 recognized as FTP - Suricata 7.0.9

hi Suricata Team,

I am testing suricata 7.0.9 and seeing that pop3 is recognized as FTP by suricata 7.0.9.

I found the below threads online, which is related to suricata 7.0.1, is this issue still relavant for suricata 7.0.9 ?

I have attached the packet captures of the pop3 flow from my testing.

threads regarding pop3 identified as FTP.

sample pop3 capture from my test

pop3.pcapng (445.1 KB)


Date: 6/9/2025 – 13:30:30 (uptime: 0d, 00h 08m 00s)

Counter | TM Name | Value

ips.accepted | Total | 40
ips.blocked | Total | 28
ips.drop_reason.flow_drop | Total | 24
ips.drop_reason.applayer_error | Total | 4
capture.kernel_packets | Total | 68
capture.afpacket.polls | Total | 47669
capture.afpacket.poll_timeout | Total | 47602
capture.afpacket.poll_data | Total | 67
decoder.pkts | Total | 68
decoder.bytes | Total | 4956
decoder.ipv4 | Total | 68
decoder.ethernet | Total | 68
decoder.tcp | Total | 68
tcp.syn | Total | 4
tcp.synack | Total | 4
tcp.rst | Total | 8
decoder.vlan | Total | 68
decoder.avg_pkt_size | Total | 72
decoder.max_pkt_size | Total | 127
tcp.active_sessions | Total | 4
flow.total | Total | 4
flow.active | Total | 4
flow.tcp | Total | 4
flow.wrk.spare_sync_avg | Total | 100
flow.wrk.spare_sync | Total | 3
tcp.sessions | Total | 4
tcp.ssn_from_pool | Total | 4
tcp.segment_from_cache | Total | 23
tcp.segment_from_pool | Total | 9
app_layer.flow.ftp | Total | 4
app_layer.tx.ftp | Total | 16
app_layer.error.ftp.parser | Total | 4
flow.mgr.full_hash_pass | Total | 86
flow.mgr.rows_per_sec | Total | 11796
flow.spare | Total | 9700
flow.mgr.rows_maxlen | Total | 1
flow.mgr.flows_checked | Total | 4
flow.mgr.flows_notimeout | Total | 4
memcap_pressure | Total | 18
memcap_pressure_max | Total | 18
tcp.memuse | Total | 6225920
tcp.reassembly_memuse | Total | 1146880
ftp.memuse | Total | 892
flow.memuse | Total | 7154304

thanks in advance
Cherish

Thanks for this report, did you test with master as well ? (I think pop3 support has evolved with a full parser in 8)

1 Like

thankyou philippe antoine, i havent tested any version beyond 7.0.9. hoping to test with master / suricata 8 and update this topic.

regards
cherish

It is fixed in Suricata 8, but not back ported to Suricata 7 which has no POP3 support

1 Like