Detecting non-standard ftp usage (!= tcp 21) using IDSM2 5.0 & CN-MARS v3.4

[rsumidacisco]

Hello,

We recently installed our IDSMs and a MARS box to monitor our core traffic. I'm trying to set up a MARS "User Inspection Rule" to notify me when there is FTP traffic on a port other than port 21. Is there an easy way to do this?

I don't see any IPS sigs that will trigger on normal FTP events(e.g. open data connection success, STOR and RETR request, etc.) I'm sure someone out there has already set up something like this before? Any help is appreciated.

Ryan

[ibanezm]

There are IPS sigs that trigger on normal FTP events such as STOR and RETR. Check out 3156 and 3155. You can configure these (and any other ftp sig) to fire on a different port besides or instead of 21.

[mhellman]

Take a look at sig 3171 to get a feel for how a custom signature might look, then create your own. To be honest, I've not done a lot of custom sigs...but looking on every port for ftp-like behavior seems like it might put quite a burden on your sensor.