Empty attacker IP and port 0 with ftpdatalisten protocol

[Larrax]

ISSUE TYPE
Question

DIONAEA VERSION
0.11.0

OS / ENVIRONMENT
Debian 10

SUMMARY
Hi, I have some very basic questions.
We are running some Dionaea honeypots and consuming the data through hpfeeds. Analyzing the data, I noticed about ~50% of all events with application protocol "ftpdatalisten" have attacker IP as an empty string and source port 0. I have two questions related to this.

• Is this an expected behavior? (IMHO, at least port 0 seems like corrupted data, not a legit port number. Why not send None instead?)
• What is the meaning of such an event in the context of this "ftpdatalisten" protocol?

Thanks.
Looking forward to your replies.

STEPS TO REPRODUCE
Install dionaea from source
Run dionaea
Observe events with "ftpdatalisten" protocol

EXPECTED RESULTS
All events have legit attacker IP and port.

[welcome]

Thanks for opening your first issue here! Be sure to follow the issue template!