Actions
Bug #8966
open
AB
AB
ftp: completion_code missing and code logged as reply when the response message is empty in
Bug #8966:
ftp: completion_code missing and code logged as reply when the response message is empty in
Affected Versions:
Effort:
Difficulty:
Label:
Description
I have a pcap where the server answers QUIT with a status code and an empty message. The bytes on the wire are exactly 221 \r\n — three digit code, one space separator, zero-length message.
Suricata 8.0.6 logs that transaction as:
{"command": "QUIT", "reply": ["221"], "reply_received": "yes", "reply_truncated": false}
No completion_code, and the code itself ends up in reply. 7.0.13 on the same pcap logs completion_code: ["221"].
I have fix I will suggest in a dedicated MR
Actions