<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><br><div><br>On 15 Apr 2018, at 02:40, Carl Rotenan <<a href="mailto:carlrotenan@gmail.com">carlrotenan@gmail.com</a>> wrote:<br><br></div><blockquote type="cite"><div><div dir="ltr"><div><div><div>Hello,<br><br></div>I'm just getting started with Suricata and I'm looking to find out if files from an FTP stream can be extracted. I have read that HTTP and SMTP but I can't find anything definitive on FTP.<br><br></div></div></div></div></blockquote><div><br></div><div>For some examples and info</div><div>You can have a look here - </div><div><a href="http://suricata.readthedocs.io/en/latest/file-extraction/file-extraction.html">http://suricata.readthedocs.io/en/latest/file-extraction/file-extraction.html</a></div><div><br></div><div>And here - </div><div><a href="https://github.com/OISF/suricata/blob/master/rules/files.rules">https://github.com/OISF/suricata/blob/master/rules/files.rules</a> </div><div><br></div><div>Feedback on the latest Suricata or 4.1beta1 is appreciated ! :)</div><div><br></div><br><blockquote type="cite"><div><div dir="ltr"><div>Thanks,<br><br></div>Carl<br></div>
</div></blockquote><blockquote type="cite"><div><span>_______________________________________________</span><br><span>Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</a></span><br><span>Site: <a href="http://suricata-ids.org">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/">http://suricata-ids.org/support/</a></span><br><span>List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a></span><br><span></span><br><span>Conference: <a href="https://suricon.net">https://suricon.net</a></span><br><span>Trainings: <a href="https://suricata-ids.org/training/">https://suricata-ids.org/training/</a></span></div></blockquote></body></html>