Suricata

FTP bounce detection has false positives and false negatives on platforms where host byte order is the same as network byte order. An example of this behavior can be triggered with the traffic attached pcap, which is also used in the suricata-verify test. The traffic contains the following:

• A valid active FTP control transaction setting up the data port.
• A active FTP control transaction setting up an FTP bounce attack.
  On big-endian platforms both flows will be detected as an FTP bounce attack. I tested this on x86_64 and mips64 platforms.