# Suricata 7.0.1 POP3 seen as FTP protocol

**URL:** <https://forum.suricata.io/t/suricata-7-0-1-pop3-seen-as-ftp-protocol/3986>\
**Category:** Help\
**Tags:** suricata\
**Created:** [October 3, 2023, 9:53am UTC](https://forum.suricata.io/t/suricata-7-0-1-pop3-seen-as-ftp-protocol/3986 "2023-10-03T09:53:20Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![atbohmer](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/atbohmer/32/1853_2.png) [@atbohmer](https://forum.suricata.io/u/atbohmer)\
**Post date:** [October 3, 2023, 9:53am UTC](https://forum.suricata.io/t/suricata-7-0-1-pop3-seen-as-ftp-protocol/3986/1 "2023-10-03T09:53:20Z")

</div>

Hi,  
Looking for EXIM related traffic if found some records with tcp dest port 110 but intepreted as FTP protocol. ftp.reply, at least suricata thinks it is a ftp reply, looks like " +OK, Return-Path:" but is seems as a POP3 stream.  
Cheers,  
Andre

---

<div class="post-metadata">

**Author:** ![vjulien](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/vjulien/32/4_2.png) [@vjulien](https://forum.suricata.io/u/vjulien)\
**Post date:** [October 3, 2023, 10:36am UTC](https://forum.suricata.io/t/suricata-7-0-1-pop3-seen-as-ftp-protocol/3986/2 "2023-10-03T10:36:23Z")

</div>

Work is being done to improve this, see

> <https://github.com/OISF/suricata/pull/9500>
>
> Link to \[redmine\](https://redmine.openinfosecfoundation.org/projects/suricata/is…sues) ticket:
> https://redmine.openinfosecfoundation.org/issues/6366
> 
> Describe changes:
> \- pop3 protocol detection
> 
> \### Provide values to any of the below to override the defaults.
> 
> https://github.com/OISF/suricata-verify/pull/1389
> \`\`\`
> SV\_BRANCH=pr/1389
> \`\`\`
> 
> First preliminary part for https://github.com/OISF/suricata/pull/8892 and https://redmine.openinfosecfoundation.org/issues/1125
> 
> This will require a QA rebaseline
> 
> After that :
> \- QA baseline is wrong because of counting IRC flows on port 5432 as pgsql because pgsql probing parser to client accepts anything
> \- See first commits of #8892 about generic protocol detection and see if we can craft tests to identify these bugs
> \- Make eve.json stats field about flows match the count of flow with app\_proto because of so many corner cases
> \- Add FTP and SMTP server side detection