7.17.5 ftp notices
The FTP analyzer can generate the following Notices:
- FTP::FTP_BadPort - Bad format in PORT/PASV
- FTP::FTP_ExcessiveFilename - Very long filename seen
- FTP::FTP_PrivPort - Privileged port used in PORT/PASV
- FTP::FTP_Sensitive -Sensitive connection (as defined in hot)
- FTP::FTP_UnexpectedConn - Data transfer from unexpected src.
Suppose there's an FTP session between client A and server B, and either
A issues a PORT or B issues a PASV. Then what's expected is that A will
rendezvous with B using the port specified in the PORT/PASV. If instead
a new IP address C connects to (or accepts from) the negotiated port, that
generated FTP_UnexpectedConn.