Suricata

Running suricata in IPS mode with a ftp-data drop rule to match on MD5. The event is alerted and with a drop rule, logging claims it is dropped but the FTP data packet gets through and the ftp client gets the file. The next TCP acks are blocked.

The EICAR file is a small file so it is only 1 ftp data packet. I don't know if more packets to trigger the md5 match would affect the behaviour.

See suricata-verify/tests/smtp-attachment-md5/ for same md5 and similar rule used but with ftp-data or ip protocol instead. I haven't tried other hash methods.

Tested on 8.0.1, 7.0.8, 7.0.6, 7.0.3. Also 4.0.6 but that was a heavily modified version.

Attached packet captures are of the client side.