Technical Tip: FTP_GET and FTP_PUT default custom service behavior

keithli_FTNT · ‎04-22-2021

Description
This article document the expected behavior of the default FTP_GET and FTP_PUT service objects.

Solution
Using FTP_GET will block uploads (STOR command).
Using FTP_PUT will block downloads (RETR command).

The result will be an ERROR in the FTP control channel.

FTP_GET example.

2021-03-04 20:22:38.873737 lan in 192.168.0.55.55347 -> 66.111.2.37.21: psh 247182145 ack 2811218789
0x0000 0000 0000 0001 a4fc 7733 6be1 0800 4500 ........w3k...E.
0x0010 0037 fc58 4000 8006 f8f4 c0a8 0037 426f .7.X@........7Bo
0x0020 0225 d833 0015 0ebb b341 a78f cb65 5018 .%.3.....A...eP.
0x0030 1f65 f97c 0000 5354 4f52 2066 696c 652e .e.|..STOR.file.
0x0040 7478 740d 0a txt..

2021-03-04 20:22:38.873764 wan1 out 173.224.108.123.55347 -> 66.111.2.37.21: psh 247182147 ack 2811218789
0x0000 0000 0000 0000 e81c baa5 a67e 0800 4500 ...........~..E.
0x0010 002f fc58 4000 7f06 a080 ade0 6c7b 426f ./.X@.......l{Bo
0x0020 0225 d833 0015 0ebb b343 a78f cb65 5018 .%.3.....C...eP.
0x0030 1f65 3085 0000 4552 524f 520d 0a .e0...ERROR..

FTP_PUT example.

2021-03-09 17:48:24.718641 lan in 192.168.0.55.56021 -> 66.111.2.37.21: psh 2879416868 ack 3967158291
0x0000 0000 0000 0001 a4fc 7733 6be1 0800 4500 ........w3k...E.
0x0010 0036 9177 4000 8006 63d7 c0a8 0037 426f .6.w@...c....7Bo
0x0020 0225 dad5 0015 aba0 6a24 ec76 0813 5018 .%......j$.v..P.
0x0030 1f12 7da9 0000 5245 5452 2066 7470 6c69 ..}...RETR.ftpli
0x0040 7374 0d0a st..

2021-03-09 17:48:24.718668 wan1 out 173.224.108.123.56021 -> 66.111.2.37.21: psh 2879416870 ack 3967158291
0x0000 0000 0000 0000 e81c baa5 a67e 0800 4500 ...........~..E.
0x0010 002f 9177 4000 7f06 0b62 ade0 6c7b 426f ./.w@....b..l{Bo
0x0020 0225 dad5 0015 aba0 6a26 ec76 0813 5018 .%......j&.v..P.
0x0030 1f12 58d9 0000 4552 524f 520d 0a ..X...ERROR..