Project

General

Profile

Actions

Bug #5263

open

Flow is stuck if there is no traffic

Added by Brijesh Valera over 2 years ago.

Status:
New
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

Replay PCAP I have attached here. It's FTP control and data-channel PCAP.

On replaying PCAP, I see FTP data channel is getting detected but I don't see FLOW event gets generated for FTP data channel.
FTP data-channel flow gets stuck if there is no further traffic is sent to Suricata engine.

On terminating Suricata, I see Flow is getting removed and FlowEvent gets generated.


Files

ftp_case144.pcap (24.4 KB) ftp_case144.pcap FTP control and data channel flows Brijesh Valera, 04/11/2022 05:31 PM

No data to display

Actions

Also available in: Atom PDF