atbohmer
October 3, 2023, 9:53am
1
Hi,
vjulien
October 3, 2023, 10:36am
2
Work is being done to improve this, see
OISF:master ← catenacyber:pop3-protocol-detection-6366-v1
opened 08:11AM - 19 Sep 23 UTC
Link to [redmine](https://redmine.openinfosecfoundation.org/projects/suricata/is… sues) ticket:
https://redmine.openinfosecfoundation.org/issues/6366
Describe changes:
- pop3 protocol detection
### Provide values to any of the below to override the defaults.
https://github.com/OISF/suricata-verify/pull/1389
```
SV_BRANCH=pr/1389
```
First preliminary part for https://github.com/OISF/suricata/pull/8892 and https://redmine.openinfosecfoundation.org/issues/1125
This will require a QA rebaseline
After that :
- QA baseline is wrong because of counting IRC flows on port 5432 as pgsql because pgsql probing parser to client accepts anything
- See first commits of #8892 about generic protocol detection and see if we can craft tests to identify these bugs
- Make eve.json stats field about flows match the count of flow with app_proto because of so many corner cases
- Add FTP and SMTP server side detection