# Suricata-4.1.2 ftp extraction **URL:** \ **Category:** Help\ **Tags:** file-extraction\ **Created:** [May 21, 2020, 7:46am UTC](https://forum.suricata.io/t/suricata-4-1-2-ftp-extraction/245 "2020-05-21T07:46:06Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![ics\_wong](https://avatars.discourse-cdn.com/v4/letter/i/a5b964/32.png) [@ics\_wong](https://forum.suricata.io/u/ics_wong)\ **Post date:** [May 21, 2020, 7:46am UTC](https://forum.suricata.io/t/suricata-4-1-2-ftp-extraction/245/1 "2020-05-21T07:46:06Z")
hello.i have a question about suricata-4.1.2 ftp extraction. my signature example: alert ftp-data any any -\> any any (msg:“FTP store password”; filestore; sid:3; rev:1;) suricata.yaml - file-store: version: 2 enabled: yes force-filestore: yes now. All http protocol about file extracted. i try ftp RETR STOR.but always empty. please help me. ---
**Author:** ![ics\_wong](https://avatars.discourse-cdn.com/v4/letter/i/a5b964/32.png) [@ics\_wong](https://forum.suricata.io/u/ics_wong)\ **Post date:** [May 21, 2020, 8:35am UTC](https://forum.suricata.io/t/suricata-4-1-2-ftp-extraction/245/2 "2020-05-21T08:35:23Z")
everybody wake up. 🤣 ---
**Author:** ![vjulien](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/vjulien/32/4_2.png) [@vjulien](https://forum.suricata.io/u/vjulien)\ **Post date:** [May 22, 2020, 10:59am UTC](https://forum.suricata.io/t/suricata-4-1-2-ftp-extraction/245/3 "2020-05-22T10:59:27Z")
I would suggest repeating the test with a supported version, so 4.1.8 or 5.0.3. ---
**Author:** ![ics\_wong](https://avatars.discourse-cdn.com/v4/letter/i/a5b964/32.png) [@ics\_wong](https://forum.suricata.io/u/ics_wong)\ **Post date:** [May 25, 2020, 1:07am UTC](https://forum.suricata.io/t/suricata-4-1-2-ftp-extraction/245/4 "2020-05-25T01:07:14Z")
thank for you suggest. i tried 4.1.8.And no file extracted.I guess it’s a compilation problem. [config.log](https://forum.suricata.io/uploads/short-url/lfDMYwFd6dKsKIJ82qF9zrQprUj.log) (144.4 KB) Is this compilate lost something? ---
**Author:** ![vjulien](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/vjulien/32/4_2.png) [@vjulien](https://forum.suricata.io/u/vjulien)\ **Post date:** [May 25, 2020, 5:36am UTC](https://forum.suricata.io/t/suricata-4-1-2-ftp-extraction/245/5 "2020-05-25T05:36:09Z")
I’m a bit confused. Is compilation failing? Can you post your configure line and its output to the screen? ---
**Author:** ![ics\_wong](https://avatars.discourse-cdn.com/v4/letter/i/a5b964/32.png) [@ics\_wong](https://forum.suricata.io/u/ics_wong)\ **Post date:** [May 25, 2020, 5:48am UTC](https://forum.suricata.io/t/suricata-4-1-2-ftp-extraction/245/6 "2020-05-25T05:48:46Z")
thank u. no. Compilate isn’t failed. i think maybe when i running ./configure omission some variables. [session.log](https://forum.suricata.io/uploads/short-url/xgTHSew6p6p6tMyPb9pD2k7J6ud.log) (25.6 KB) ---
**Author:** ![vjulien](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/vjulien/32/4_2.png) [@vjulien](https://forum.suricata.io/u/vjulien)\ **Post date:** [May 25, 2020, 5:54am UTC](https://forum.suricata.io/t/suricata-4-1-2-ftp-extraction/245/7 "2020-05-25T05:54:11Z")
I don’t understand what you’re asking. Can explain again what it is you need help with? ---
**Author:** ![ics\_wong](https://avatars.discourse-cdn.com/v4/letter/i/a5b964/32.png) [@ics\_wong](https://forum.suricata.io/u/ics_wong)\ **Post date:** [May 25, 2020, 6:15am UTC](https://forum.suricata.io/t/suricata-4-1-2-ftp-extraction/245/8 "2020-05-25T06:15:35Z")
please forgive me for my bad english.i want using suricata extracte file for ftp protocol.but i couldn’t capture anything.I want to determine the cause of the problem. ---
**Author:** ![ics\_wong](https://avatars.discourse-cdn.com/v4/letter/i/a5b964/32.png) [@ics\_wong](https://forum.suricata.io/u/ics_wong)\ **Post date:** [May 25, 2020, 6:26am UTC](https://forum.suricata.io/t/suricata-4-1-2-ftp-extraction/245/9 "2020-05-25T06:26:59Z")
i read the official document to configure the suricata.yaml. > [4.20. FTP/FTP-DATA Keywords — Suricata 4.1.0-dev documentation](https://suricata.readthedocs.io/en/suricata-4.1.2/rules/ftp-keywords.html) > [8.1. Suricata.yaml — Suricata 4.1.0-dev documentation](https://suricata.readthedocs.io/en/suricata-4.1.2/configuration/suricata-yaml.html#file-store-file-extraction) i use suricata-4.1.8 with same configure.but didn’t capture file. so i don’t known how to decide the problem. ---
**Author:** ![Jeff\_Lucovsky](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jeff_lucovsky/32/11_2.png) [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)\ **Post date:** [May 25, 2020, 11:17pm UTC](https://forum.suricata.io/t/suricata-4-1-2-ftp-extraction/245/10 "2020-05-25T23:17:13Z")
Can you share a pcap file that demonstrates the problem? Do you know if it’s active or passive FTP? ---
**Author:** ![ics\_wong](https://avatars.discourse-cdn.com/v4/letter/i/a5b964/32.png) [@ics\_wong](https://forum.suricata.io/u/ics_wong)\ **Post date:** [May 26, 2020, 8:15am UTC](https://forum.suricata.io/t/suricata-4-1-2-ftp-extraction/245/11 "2020-05-26T08:15:29Z")
[134\_ftp\_active.pcap](https://forum.suricata.io/uploads/short-url/gC7EoY3Wu8uYGeDB7LdFea4dgfC.pcap) (18.0 KB) [134\_ftp\_passive.pcap](https://forum.suricata.io/uploads/short-url/7JDy4wDSqiDdhrspTehPZjbbGAd.pcap) (5.7 KB) Thank you very much.I check it and found i use ftp active model default. I try the passive model when you tips me.And i capture those FTP files. 😁 But why i couldn’t extracte files when active FTP ? ---
**Author:** ![Jeff\_Lucovsky](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jeff_lucovsky/32/11_2.png) [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)\ **Post date:** [May 26, 2020, 11:54am UTC](https://forum.suricata.io/t/suricata-4-1-2-ftp-extraction/245/12 "2020-05-26T11:54:56Z")
FTP active mode support is fully supported in 5.0.x (5.0.3 is the latest). ---
**Author:** ![ics\_wong](https://avatars.discourse-cdn.com/v4/letter/i/a5b964/32.png) [@ics\_wong](https://forum.suricata.io/u/ics_wong)\ **Post date:** [May 26, 2020, 3:20pm UTC](https://forum.suricata.io/t/suricata-4-1-2-ftp-extraction/245/13 "2020-05-26T15:20:40Z")
Could I think that 4.1.8 supported the active FTP ? If I use the 5.0.3. i have to rewrite too many source code. Because i develop some industrial control protocol parsers in 4.1.2. 😳 ---
**Author:** ![Andreas\_Herz](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/andreas_herz/32/52_2.png) [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)\ **Post date:** [May 26, 2020, 7:59pm UTC](https://forum.suricata.io/t/suricata-4-1-2-ftp-extraction/245/14 "2020-05-26T19:59:56Z")
> [@ics\_wong](#): > > If I use the 5.0.3. i have to rewrite too many source code. > Because i develop some industrial control protocol parsers in 4.1.2. 😳 It will be also required as soon as 4.1.x is EOL. So we highly recommend that you update it to the current master code base and ideally in Rust. We would welcome new protocol additions especially from that area since we see more and more people asking for those. ---
**Author:** ![ics\_wong](https://avatars.discourse-cdn.com/v4/letter/i/a5b964/32.png) [@ics\_wong](https://forum.suricata.io/u/ics_wong)\ **Post date:** [May 27, 2020, 3:50am UTC](https://forum.suricata.io/t/suricata-4-1-2-ftp-extraction/245/15 "2020-05-27T03:50:16Z")
thanks.i will try 5.0.3.