Suricata-4.1.2 ftp extraction

Help
1

hello.i have a question about suricata-4.1.2 ftp extraction.
my signature example: alert ftp-data any any -> any any (msg:“FTP store password”; filestore; sid:3; rev:1;)
suricata.yaml

  • file-store:
    version: 2
    enabled: yes
    force-filestore: yes

now. All http protocol about file extracted.
i try ftp RETR STOR.but always empty.
please help me.

2

everybody wake up. :rofl:

3

I would suggest repeating the test with a supported version, so 4.1.8 or 5.0.3.

4

thank for you suggest. i tried 4.1.8.And no file extracted.I guess it’s a compilation problem.
config.log (144.4 KB)
Is this compilate lost something?

5

I’m a bit confused. Is compilation failing? Can you post your configure line and its output to the screen?

6

thank u.
no. Compilate isn’t failed. i think maybe when i running ./configure omission some variables.
session.log (25.6 KB)

7

I don’t understand what you’re asking. Can explain again what it is you need help with?

8

please forgive me for my bad english.i want using suricata extracte file for ftp protocol.but i couldn’t capture anything.I want to determine the cause of the problem.

9

i read the official document to configure the suricata.yaml.

4.20. FTP/FTP-DATA Keywords — Suricata 4.1.0-dev documentation

8.1. Suricata.yaml — Suricata 4.1.0-dev documentation

i use suricata-4.1.8 with same configure.but didn’t capture file.
so i don’t known how to decide the problem.

10

Can you share a pcap file that demonstrates the problem?

Do you know if it’s active or passive FTP?

11

134_ftp_active.pcap (18.0 KB) 134_ftp_passive.pcap (5.7 KB)

Thank you very much.I check it and found i use ftp active model default.
I try the passive model when you tips me.And i capture those FTP files. :grin:
But why i couldn’t extracte files when active FTP ?

12

FTP active mode support is fully supported in 5.0.x (5.0.3 is the latest).

13

Could I think that 4.1.8 supported the active FTP ?
If I use the 5.0.3. i have to rewrite too many source code.
Because i develop some industrial control protocol parsers in 4.1.2. :flushed:

14

It will be also required as soon as 4.1.x is EOL. So we highly recommend that you update it to the current master code base and ideally in Rust. We would welcome new protocol additions especially from that area since we see more and more people asking for those.

15

thanks.i will try 5.0.3.