Re: Slow FTP on inline Snort3

To disable ftp, you can set ftp module to nil, from command line:
--lua “ftp_server = nil” or include a lua file at the end of your configuration:

if  ftp_server ~= nil then
   ftp_server = nil
   ftp_data = nil
   ftp_client = nil
end

From: Snort-users <[email protected]> on behalf of Mohammad Hachem <[email protected]>
Date: Tuesday, December 7, 2021 at 8:03 AM
To: [email protected] <[email protected]>
Subject: [Snort-users] Slow FTP on inline Snort3
Hi,

I have a Snort3 running in inline mode and only rules related to DNS traffic are enabled.
I noticed that when ftp traffic is passing through snort it’s getting significantly slower.
I checked snort and alerts logs and nothing related to ftp was found.
The only thing that I can think about that could cause this issue is the ftp_server and ftp_client inspector which are enabled by default on Snort.
I commented out the below 2 lines in my snort configuration file to try to disable these modules, but they are still running
    --{ when = { service = 'ftp' },              use = { type = 'ftp_server' } },
    --{ when = { service = 'ftp-data' },         use = { type = 'ftp_data' } },

Any idea what is the appropriate configuration to apply in order to disable these inspectors and is there any other modules on snort that could be causing this ftp slowness issue.

Regards,
Mohammad Hachem

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette