Enterasys Intrusion Prevention System Manual page 211

Table A-1 6.x to 7.0 Keyword Mapping (continued)
6.x Keyword
FTP
FTPCONVERT
FTPCONVERT_VERB
OSE
7.0 XML Attribute
NSC/SC/C/FTPAnalysis/port-request-check
NSC/SC/C/FTPAnalysis
NSC/SC/C/FTPAnalysis/verbose
Description
FTP is a switch that tells Network Sensor to
decode TCP port 21 packets and streams that
specify a port command for file transfer. The
decode extracts the command string which is of
the form port x,x,x,x,p,p where x,x,x,x is the
destination IP address and p,p is the destination
port.
If the destination IP address is not equal to the
source address of this packet, the packet is
logged as a security event. This attack may
indicate FTP port scanning, FTP mail bombing,
FTP hijacking and a variety of other suspicious
events. However, this attack could also result
from a non-passive FTP file transfer attempt from
a network address translated client. These
events are labeled with the [FTP-BOUNCE]
name.
When this command is enabled, Network Sensor
will also look for general port requests (the p,p
from the x,x,x,x,p,p), which specify addresses
lower than port 1024. Such a port may indicate
attempts at email spoofing, remote login
attempts and other types of attacks. These
events are labeled with the
FTP-BOUNCE:LOWPORT event.
The FTP protocol works by establishing a control
connection and a data connection when data
needs to be sent. The control connection can
use Telnet commands that begin with the IAC
byte (0xff). FTPAnalysis watches the control
connection for these types of commands and
interprets them for signature matching.
Many times when an IAC command is sent in an
FTP control connection, it is used as an attempt
to evade IDS. If "NSC/SC/C/FTPAnalysis/
verbose" on page A-17 is set, an event will be
received for these types of evasions.
Performs the same protocol conversions as
"NSC/SC/C/FTPAnalysis" on page A-17, except
that it logs events when possible IDS evasion
techniques are used. The current event that is
logged when evasion is detected is: FTP:IAC-
EVADE
Technical Note
For details on this evasion, refer to the
"NSC/SC/C/FTPAnalysis" on page A-17
description.
Creating Network Sensor Policies and Signatures A-17
6.x to 7.x Mappings