<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Hi guys,<br>
<br>
I have been struggling a few days to the function file extraction,
the reference doc is:
<a class="moz-txt-link-freetext" href="http://suricata.readthedocs.io/en/latest/file-extraction/file-extraction.html?highlight=ftp">http://suricata.readthedocs.io/en/latest/file-extraction/file-extraction.html?highlight=ftp</a>.
The protocol that I want to use is FTP. <br>
1) Suricata version is latest that cloned from github.<br>
2) I setup the suricata.yaml: file-store.enabled: yes<br>
3) I create a rule file hello.rules, its content is: <br>
<pre style="box-sizing: border-box; font-family: Consolas, "Andale Mono WT", "Andale Mono", "Lucida Console", "Lucida Sans Typewriter", "DejaVu Sans Mono", "Bitstream Vera Sans Mono", "Liberation Mono", "Nimbus Mono L", Monaco, "Courier New", Courier, monospace; font-size: 12px; white-space: pre; margin: 0px; padding: 12px; line-height: normal; display: block; overflow: auto; color: rgb(64, 64, 64); font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); text-decoration-style: initial; text-decoration-color: initial;"><span class="n" style="box-sizing: border-box; color: rgb(51, 51, 51);">alert</span> <span class="n" style="box-sizing: border-box; color: rgb(51, 51, 51);">http</span> <span class="nb" style="box-sizing: border-box; color: rgb(0, 134, 179);">any</span> <span class="nb" style="box-sizing: border-box; color: rgb(0, 134, 179);">any</span> <span class="o" style="box-sizing: border-box; font-weight: bold;">-></span> <span class="nb" style="box-sizing: border-box; color: rgb(0, 134, 179);">any</span> <span class="nb" style="box-sizing: border-box; color: rgb(0, 134, 179);">any</span> <span class="p" style="box-sizing: border-box;">(</span><span class="n" style="box-sizing: border-box; color: rgb(51, 51, 51);">msg</span><span class="p" style="box-sizing: border-box;">:</span><span class="s2" style="box-sizing: border-box; color: rgb(221, 17, 68);">"FILE store all"</span><span class="p" style="box-sizing: border-box;">;</span> <span class="n" style="box-sizing: border-box; color: rgb(51, 51, 51);">filestore</span><span class="p" style="box-sizing: border-box;">;</span> <span class="n" style="box-sizing: border-box; color: rgb(51, 51, 51);">sid</span><span class="p" style="box-sizing: border-box;">:</span><span class="mi" style="box-sizing: border-box; color: rgb(0, 153, 153);">1</span><span class="p" style="box-sizing: border-box;">;</span> <span class="n" style="box-sizing: border-box; color: rgb(51, 51, 51);">rev</span><span class="p" style="box-sizing: border-box;">:</span><span class="mi" style="box-sizing: border-box; color: rgb(0, 153, 153);">1</span><span class="p" style="box-sizing: border-box;">;)
</span></pre>
<span class="p" style="box-sizing: border-box;">4)</span>
./configure --prefix=/usr/ --sysconfdir=/etc/ --localstatedir=/var/<br>
5) make && make install <br>
<br>
My testing pcap is in the attachment. but I cannot find the
file(Music.mp3) was extracted and saved into the disk
(/var/log/suricata/files/). <br>
Has anybody ever been successful about extraction FTP file into
disk?<br>
<br>
And then I read the code, and cannot find which code is responsible
for saving file into the disk? <br>
I guess the process is:<br>
<pre style="background-color:#ffffff;color:#000000;font-family:'DejaVu Sans Mono';font-size:11.3pt;">FTPDataParseRequest-->FTPDataParse-->FileOpenFile|FileAppendData--><span style="color:#371f80;">StreamingBuffer
</span><span style="color:#371f80;"></span></pre>
but the data is still in memory, where is save the StreamingBuffer
into the disk?<br>
<br>
Any advice is welcome.<br>
Thanks a lot,<br>
Kris<br>
<br>
<pre style="background-color:#ffffff;color:#000000;font-family:'DejaVu Sans Mono';font-size:11.3pt;"><span style="color:#371f80;"></span></pre>
<span class="p" style="box-sizing: border-box;"></span>
</body>
</html>