['flow', 'ftp', 'ftp', 'ftp', 'ftp', 'ftp', 'ftp', 'ftp', 'ftp']
src_ip: 172.16.0.1, src_port: 59310, dest_ip: 192.168.10.50, dest_port: 21, event_type: flow, proto: TCP, app_proto: ftp, flow_pkts_toserver: 11, flow_pkts_toclient: 17, flow_bytes_toserver: 868, flow_bytes_toclient: 1306, flow_age: 9, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1f, tcp_tcp_flags_ts: 1b, tcp_tcp_flags_tc: 1f, tcp_syn: True, tcp_fin: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; pcap_cnt: 6706547, event_type: ftp, proto: TCP, tx_id: 0, ftp_completion_code_0: 220, ftp_reply_0: (vsFTPd 3.0.3), ftp_reply_received: yes, ftp_reply_truncated: False ; pcap_cnt: 6706551, event_type: ftp, proto: TCP, tx_id: 1, ftp_command: USER, ftp_command_data: iscxtap, ftp_command_truncated: False, ftp_completion_code_0: 331, ftp_reply_0: Please specify the password., ftp_reply_received: yes, ftp_reply_truncated: False ; pcap_cnt: 6706819, event_type: ftp, proto: TCP, tx_id: 2, ftp_command: PASS, ftp_command_data: 04HmoC9Z	87eIXcDQV46aU, ftp_command_truncated: False, ftp_completion_code_0: 530, ftp_reply_0: Login incorrect., ftp_reply_received: yes, ftp_reply_truncated: False ; pcap_cnt: 6706822, event_type: ftp, proto: TCP, tx_id: 3, ftp_command: USER, ftp_command_data: iscxtap, ftp_command_truncated: False, ftp_completion_code_0: 331, ftp_reply_0: Please specify the password., ftp_reply_received: yes, ftp_reply_truncated: False ; pcap_cnt: 6707119, event_type: ftp, proto: TCP, tx_id: 4, ftp_command: PASS, ftp_command_data: 04jp6ci8	jb8ibeqe6y8, ftp_command_truncated: False, ftp_completion_code_0: 530, ftp_reply_0: Login incorrect., ftp_reply_received: yes, ftp_reply_truncated: False ; pcap_cnt: 6707122, event_type: ftp, proto: TCP, tx_id: 5, ftp_command: USER, ftp_command_data: iscxtap, ftp_command_truncated: False, ftp_completion_code_0: 331, ftp_reply_0: Please specify the password., ftp_reply_received: yes, ftp_reply_truncated: False ; pcap_cnt: 6707267, event_type: ftp, proto: TCP, tx_id: 6, ftp_command: PASS, ftp_command_data: 04KH454	UF578LZ, ftp_command_truncated: False, ftp_completion_code_0: 530, ftp_reply_0: Login incorrect., ftp_reply_received: yes, ftp_reply_truncated: False ; event_type: ftp, proto: TCP, tx_id: 7, ftp_command: USER, ftp_command_data: iscxtap, ftp_command_truncated: False, ftp_reply_received: no, ftp_reply_truncated: False
The network event indicates a FTP-Patator. FTP-Patator attacks involve brute force attempts to gain access to an FTP server. Typically, the logs show multiple login attempts from the same source IP to the FTP server, often with varied credentials. This pattern of behavior is consistent with brute force attacks aiming to discover valid username and password combinations. Additionally, the logs show multiple failed login attempts with a `530 Login incorrect` response, indicating invalid credentials, and short-lived connections frequently terminated with `RST` or `FIN` flags. These characteristics align with the behavior of automated tools like FTP-Patator, which issue numerous login attempts in a short time frame.
classification: Attack
justification: The network event indicates a FTP-Patator. FTP-Patator attacks involve brute force attempts to gain access to an FTP server. Typically, the logs show multiple login attempts from the same source IP to the FTP server, often with varied credentials. This pattern of behavior is consistent with brute force attacks aiming to discover valid username and password combinations. Additionally, the logs show multiple failed login attempts with a `530 Login incorrect` response, indicating invalid credentials, and short-lived connections frequently terminated with `RST` or `FIN` flags. These characteristics align with the behavior of automated tools like FTP-Patator, which issue numerous login attempts in a short time frame.