Subject: FTP-GW hangs when large files are sent

From: "Barreira, Fernando [IT]" <[email-masked]>
Date: Fri, 27 Oct 2000 11:00:17 -0400

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

hi there, 

i have a situation in which when i transfer large files (20 megs) using the
ftp-gw, the connection stays hanged indefinitely (no problem when
transfering small files).  in other words, we don't get the message
indicating a successfull transfer or the ftp> prompt back.
at first we though the file transfer didn't go through but when we checked
the far end we saw that the file had indeed been transferred. 
this is causing a problem because we have a script that does handles this
job and allways thinks it failed.
has anyone seen any thing like this? thanks.

the machine running fwtk is as follows:

sun ultra2 sparc
solaris 5.6
fwtk version 2.1
with the following netperm-table:

#netacl-ftp-gw: permit-hosts  * -chroot /proxy/black_hole -exec
/opt/fwtk/ftp-gw
#
#       proxy-FTP rules:
#
ftp-gw: welcome-msg /opt/fwtk/msg/migrate.txt
ftp-gw: directory /proxy/black_hole
ftp-gw: userid tis-proxy
ftp-gw: groupid other
ftp-gw: permit-hosts *
ftp-gw: deny-hosts unknown
ftp-gw: timeout  30000 
#
# ==========================================
# NETACL rules for fingerit:

netacl-fingerit: deny-hosts  unknown -exec /bin/cat
/opt/fwtk/msg/fingerit-deny.
txt
netacl-fingerit: deny-hosts  * -exec /bin/cat
/opt/fwtk/msg/fingerit-deny.txt

# ==========================================
# NETACL rules for traceroute:

netacl-traceroute: deny-hosts  unknown -exec /bin/cat
/opt/fwtk/msg/traceroute-d
eny.txt
netacl-traceroute: deny-hosts  * -exec /bin/cat
/opt/fwtk/msg/traceroute-deny.tx
t

# ========================================== 
# NETACL rules for nslookup:

netacl-nslookup: deny-hosts  unknown -exec /bin/cat
/opt/fwtk/msg/nslookup-deny.
txt
netacl-nslookup: deny-hosts  * -exec /bin/cat
/opt/fwtk/msg/nslookup-deny.txt

continued...........

---

From: Ted Keller <[email-masked]>
Date: Fri, 27 Oct 2000 16:52:52 -0400 (EDT)

Fernando,

You might want to check to see if either of the boxes is behind another
firewall - packet filter.  It almost sounds like you are getting timeout
issues on your command connection during the data transfer....

ted keller