dreputi Yep, I copied it wrong. It should be like this: Every time a client starts FTP session i see 2 TCP sessions in logs: - TCP session from 1.1.1.1:yyyy to 2.2.2.2:21 application ftp - followed by TCP session from 2.2.2.2:20 to 1.1.1.1:xxxx application ftp I agree that I shouldn't be opening session for the DATA traffic in the other direction. But that means 2nd session will always be blocked when we implement the drop rule. Will FTP still work? hshah Yes, I agree that predicted sessions aren't logged and that there is no such application as ftp-data needed. But I do see a TCP session in other direction in traffic log, it's recognised as ftp application, there was some data transfered through it and it always appears after a ftp session from client to server. And that means I need to explicitly open everything from source port 20 in the other direction?
... View more
