Splunk Apps » FTP Receiver

Observations:

• Making an input manually works
  • Even without anonymous support
• The port is open: netstat -nab
• The logs indicate that the server has started:
  • (index=_internal sourcetype=ftp_modular_input) OR (sourcetype=ftp)
  • index=_internal execprocessor ftp sourcetype=splunkd
• No logs indicate anything about the connection being made

• It appears that the server cannot serve on the blank port

The following does not work:

from pyftpdlib.authorizers import DummyAuthorizer
from pyftpdlib.handlers import FTPHandler
from pyftpdlib.servers import FTPServer

authorizer = DummyAuthorizer()
authorizer.add_user("user", "12345", "C:\\", perm="elradfmw")
#authorizer.add_anonymous("C:\\")

handler = FTPHandler
handler.authorizer = authorizer

#server = FTPServer(("127.0.0.1", 2122), handler)
server = FTPServer(("", 2122), handler)
server.serve_forever()

I bet the webhooks app is also affected.

Netstat shows listening on:

 TCP    [::]:2122              [::]:0                 LISTENING
[python.exe]

Other ports show a different listening port status:

[svchost.exe]
 UDP    [::1]:59854            *:*
 SSDPSRV