Feature #1125
closedsmtp: improve protocol detection
Added by Victor Julien over 10 years ago. Updated 4 months ago.
Description
Currently SMTP is only detected if the client starts the conversation with HELO, EHLO or QUIT.
The server stream is not used for protocol detection.
Updated by Victor Julien about 9 years ago
- Target version changed from 3.0RC2 to 70
Updated by Victor Julien over 6 years ago
- Assignee changed from Tom DeCanio to OISF Dev
Updated by Victor Julien over 6 years ago
- Blocked by Feature #2572: extend protocol detection to specify flow direction added
Updated by Victor Julien almost 6 years ago
- Priority changed from Normal to High
Updated by Victor Julien almost 6 years ago
- Related to Task #2757: improve protocol detection added
Updated by Victor Julien almost 6 years ago
- Priority changed from High to Normal
- Target version changed from 70 to 5.0beta1
Updated by Victor Julien over 5 years ago
- Status changed from New to Assigned
- Assignee changed from OISF Dev to Philippe Antoine
- Priority changed from High to Normal
Updated by Victor Julien over 5 years ago
- Target version changed from 5.0beta1 to 5.0rc1
Updated by Philippe Antoine over 5 years ago
- Related to Bug #2978: IRC traffic parsed by FTP added
Updated by Victor Julien about 5 years ago
- Target version changed from 5.0rc1 to 6.0.0beta1
Updated by Philippe Antoine almost 5 years ago
- Related to deleted (Task #2757: improve protocol detection)
Updated by Philippe Antoine almost 5 years ago
- Blocked by Task #2757: improve protocol detection added
Updated by Philippe Antoine over 4 years ago
- Status changed from Assigned to Feedback
Waiting first for feedback on other related tickets
Updated by Philippe Antoine over 4 years ago
Waiting for feedback on https://redmine.openinfosecfoundation.org/issues/2757 before upgrading
https://github.com/OISF/suricata/pull/3832
https://github.com/OISF/suricata-verify/pull/53
Updated by Victor Julien over 4 years ago
- Target version changed from 6.0.0beta1 to 7.0.0-beta1
Updated by Philippe Antoine over 2 years ago
Both FTP and SMTP start with 220 from server (followed by either space or hyphen)
For SMTP, it is then supposed to be a valid domain name.
But there is no restriction for FTP
There can be (E)SMTP or FTP in the banner...
We can use the ports.
And we can maybe mark this detection as weak, so that client side detection overrides it...
Updated by Philippe Antoine over 2 years ago
- Status changed from Feedback to In Review
Updated by Philippe Antoine over 2 years ago
- Blocked by deleted (Task #2757: improve protocol detection)
Updated by Philippe Antoine over 2 years ago
- Related to Task #2757: improve protocol detection added
Updated by Philippe Antoine about 2 years ago
- Priority changed from Normal to Low
Updated by Victor Julien about 2 years ago
- Target version changed from 7.0.0-beta1 to 7.0.0-rc1
Updated by Philippe Antoine almost 2 years ago
- Blocked by Bug #5769: Incomplete values for .stats."app_layer".flow.proto added
Updated by Victor Julien almost 2 years ago
- Target version changed from 7.0.0-rc1 to 8.0.0-beta1
Updated by Philippe Antoine about 1 year ago
- Related to Bug #6283: FTP parsing yields in some cases smtp and http event types added
Updated by Philippe Antoine about 1 year ago
- Related to Feature #6366: pop3 protocol detection added
Updated by Philippe Antoine about 1 year ago
- Target version changed from 8.0.0-beta1 to TBD
Updated by Victor Julien 12 months ago
- Related to Bug #6591: protodetect: ftp parsed as smtp added
Updated by Philippe Antoine 6 months ago
- Target version changed from TBD to 8.0.0-beta1
Updated by Philippe Antoine 4 months ago
- Status changed from In Review to Closed