Invalid port command

[cteplansky]

This triggers an invalid port command signature 3154. Looking at the context buffer you can see port 3nary which would be invalid. Why is the context buffer showing this. Is the IDS confusing the data since I would assume the port 3nary would be type binary? Example below

PORT 10,10,10,219,4,8

RETR ****_*******

PORT 3NARY.

226 Transfer finished successfully. Data connection closed.

200 Port command okay.

[bkubesh]

The context buffer is showing the PORT 3NARY because that is what it is alarming on. It thinks the user is sending another port command, and the port command appears to be invalid since it is not in comma separated decimal format as described by the RFC.

What is PORT 3NARY supposed to be? I dont recognize it? It is not in binary format. This is the ftp control channel and the actual data is transferred on a different port. ASCII format only on this port/channel.

-BK