Slow FTP on inline Snort3

Hi,

 

I have a Snort3 running in inline mode and only rules related to DNS traffic
are enabled.

I noticed that when ftp traffic is passing through snort it’s getting
significantly slower.

I checked snort and alerts logs and nothing related to ftp was found.

The only thing that I can think about that could cause this issue is the
ftp_server and ftp_client inspector which are enabled by default on Snort.

I commented out the below 2 lines in my snort configuration file to try to
disable these modules, but they are still running

    --{ when = { service = 'ftp' },              use = { type = 'ftp_server'
} },

    --{ when = { service = 'ftp-data' },         use = { type = 'ftp_data' }
},

 

Any idea what is the appropriate configuration to apply in order to disable
these inspectors and is there any other modules on snort that could be
causing this ftp slowness issue.

 

Regards,

Mohammad Hachem

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette