ftp.pat 1.5 KB

12345678910111213141516171819202122232425262728293031323334
  1. # FTP - File Transfer Protocol - RFC 959
  2. # Pattern quality: great fast
  3. #
  4. # Usually runs on port 21. Note that the data stream is on a dynamically
  5. # assigned port, which means that you will need the FTP connection
  6. # tracking module in your kernel to usefully match FTP data transfers.
  7. #
  8. # This pattern is well tested. If it does not
  9. # work for you, or you believe it could be improved, please post to
  10. # l7-filter-developers@lists.sf.net . This list may be subscribed to at
  11. # http://lists.sourceforge.net/lists/listinfo/l7-filter-developers
  12. #
  13. # Matches the first two things a server should say. Most servers say
  14. # something after 220, even though they don't have to, and it usually
  15. # includes the string "ftp" (l7-filter is case insensitive).
  16. # This includes proftpd, vsftpd, wuftpd, warftpd, pureftpd, Bulletproof
  17. # FTP Server, and whatever ftp.microsoft.com uses. Just in case, the next
  18. # thing the server sends is a 331. All the above servers also send
  19. # something including "password" after this code.
  20. ftp
  21. # actually, let's just do the first for now, it's faster
  22. ^220[\x09-\x0d -~]*ftp
  23. # This is ~10x faster if the stream starts with "220"
  24. #^220.*ftp
  25. # This will match more, but much slower
  26. #^220[\x09-\x0d -~]*ftp|331[\x09-\x0d -~]*password
  27. # This pattern is more precise, but takes longer to match. (3 packets vs. 1)
  28. #^220[\x09-\x0d -~]*\x0d\x0aUSER[\x09-\x0d -~]*\x0d\x0a331
  29. # same as above, but slightly less precise and only takes 2 packets.
  30. #^220[\x09-\x0d -~]*\x0d\x0aUSER[\x09-\x0d -~]*\x0d\x0a