Re: log ftp servers in our network

[Magnus <marix () strul net>]

At 19:15 2002-04-14 -0700, you wrote:
> On Sun, 14 Apr 2002, Banai Zoltan wrote:
>
> > Short:
> > Is it possible to log that there is ftp server in our network on _any_ 
> port?
>
> [...snip...]
>
> Short:  Not with any certainty.
>
> Longer:  For this you need something like Ntop, but that actually
> _understands_ what the protocol is supposed to "look, act, and feel."  IOW,
> you'd have to build a protocol decoder for each type of protocol that you
> wanted to look for.  Ntop might be close, but I don't know of anything that
> does exactly that.


log tcp any any -> $HOME_NET !110       -> (msg:"FTP login USER"; 
content:"USER "; )
log tcp any any -> $HOME_NET !110       -> (msg:"FTP login PASS"; 
content:"PASS "; )

Should be able to dectect incoming ftp logins..
!110 to disregard al that nice email popping...
disregarding ircd ports for USER is also nice if your network hosts a ircd..

Regards,

Magnus


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users