detect: Fix FTP bounce detection IP address comparison

Fix the FTP bounce IP address comparison by only converting the IP
parsed from the FTP payload to network order.

Bug: #6087

diff --git a/src/detect-ftpbounce.c b/src/detect-ftpbounce.c
index b9134b11cb7a3e17462003cac2f60a8a77c0c3da..318f72cf3b588edf559d6456db1e0205d80f3a0f 100644 (file)
--- a/src/detect-ftpbounce.c
+++ b/src/detect-ftpbounce.c
@@ -141,7 +141,7 @@ static int DetectFtpbounceMatchArgs(
             }
             if (noctet == 4) {
                 /* Different IP than src, ftp bounce scan */
-                ip = SCByteSwap32(ip);
+                ip = SCNtohl(ip);
 
                 if (ip != ip_orig) {
                     SCLogDebug("Different ip, so Matched ip:%d <-> ip_orig:%d",