On this page

OSSEC / HIDS Rule 11209

OSSEC / HIDS rule catalog

  • Rule family: OSSEC / HIDS
  • Rule ID: 11209
  • Definition status: Present in current source
  • Alert message / subject: proftpd: Attempt to bypass firewall that can't adequately keep state of FTP traffic.
  • Rule level: 14
  • Definition checked: 2026-10-21

Interpretation and response

This event is recorded as “proftpd: Attempt to bypass firewall that can’t adequately keep state of FTP traffic.” Review the originating log and the affected host or service to determine whether the activity was expected.

An OSSEC/HIDS event records or correlates activity. Blocking depends on the originating application and any separately configured Active Response policy; an alert alone does not prove that an attack was blocked.

Documentation

The following guidance was migrated from the historical wiki and reviewed against the rule definition. Legacy ASL product names and interface instructions refer to the versions documented then. Use the current metadata above and your installed configuration when interpreting thresholds, notification settings and response behavior.

Rule ID

11209

Status

The wiki marked this rule Active at the source revision. Current definition status is shown above.

Alert Message

proftpd: Attempt to bypass firewall that can’t adequately keep state of FTP traffic.

Example Log Entry

Illustrative event summary (not a captured log): OSSEC/HIDS 11209 — proftpd: Attempt to bypass firewall that can’t adequately keep state of FTP traffic..

Description

This rule detects when an FTP server reports that it has rejected a connection request from the client that is invalid, or possibly malicious. This generallyt occurs when a buggy client, or a poorly configured or designed firewall at the client side sends the wrong IP address for the FTP data connection, typically an internal IP address that does not match the source. In the example above, the clients IP address is 192.0.2.10, and the client as instructed the FTP server to send data to the IP address 192.0.2.11 (in the example above the application uses commas instead of periods).

This is invalid, as the FTP server is smart enough to recognize that the clients real IP address is 192.0.2.10, and not 192.168.1.34. The actual clients IP may in fact be 192.0.2.11, but the traffic will never reach it as the actual IP address the client is using is 1.2.3.4. This is typically seen, as mentioned above, when the clients firewall or FTP client does not properly manage FTP connections. This is not a problem with your server, it is a problem with the client.

False Positives

A false positive is not possible with this rule. It merely reports what the FTP server is doing.

Discussion

FTP is a very complex protocol, and one of the oldest protocols on the Internet. It is not like any other protocol. It uses multiple “channels” to send data to the client. The client can request the server to send data over a specific port and to a specific IP address. When FTP was created, the Internet was not the place it is today. There were no hackers or malicious attackers invisoned, so the protocol itself is very naive. It will allow a client to ask a server to send data to any IP and port on the Internet. This can be used to launch “bounce” attacks, where an attacker can instruct an FTP server to send data to other systems, and in so doing it can be used to bypass firewalls by attacking an FTP server behind a firewall and then using that server to attack other machines behing the firewall. Because of these limitations more modern FTP servers will check these IP addresses against the actual source IP address, and if they do not match it will reject them.

Tuning Recommendations

None. Do not disable this rule. The rule is only reporting the behavior of the FTP server, and disabling it will not prevent the FTP server from rejecting the connection. You will simply no longer be alerted that this has occurred, however the FTP server will still reject the connection, this time silently.

Source and revision

Migrated from HIDS_11209, wiki page 248, revision 2066 (20120112). Documentation review: 2026-10-21. An archived wiki status of Active is not a current deployment status.

For assistance, provide the rule ID, installed product and rule version, and a sanitized event to Atomicorp support .