Subject: still fwtk ftp-gw problem.

From: "Barreira, Fernando [IT]" <[email-masked]>
Date: Wed, 8 Nov 2000 10:01:17 -0500

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

hi there,

 we are experiencing a problem when we try ftp to a particular site,
 basically after i login, and issue a "ls" command, 
 the session gets hunged and i get:
 
ftp> ls
 200 PORT command successful.
150 Opening ASCII mode data connection for file list

basically after i issue the "ls" command, i noticed from a packet capture
that the source port changes from 21 to 47891, and the destination changes
from 36033 to 36034. is this normal for ftp?

here is the packet sequence:

TCP:  Source port = 21
TCP:  Destination port = 36033
TCP:  Sequence number = 1450748822
TCP:  Acknowledgement number = 2015767618
TCP:  Data offset = 20 bytes
TCP:  Flags = 0x18
TCP:        ..0. .... = No urgent pointer
TCP:        ...1 .... = Acknowledgement
TCP:        .... 1... = Push
TCP:        .... .0.. = No reset
TCP:        .... ..0. = No Syn
TCP:        .... ...0 = No Fin
TCP:  Window = 8760
TCP:  Checksum = 0xbec6
TCP:  Urgent pointer = 0
TCP:  No options
TCP:
FTP:  ----- FTP:   -----
FTP:
FTP:  "150 Opening ASCII mode data connection for file list.\r\n"
FTP:

ETHER:  ----- Ether Header -----
ETHER:
ETHER:  Packet 28 arrived at 15:52:38.53
ETHER:  Packet size = 60 bytes
ETHER:  Destination = 8:0:20:74:f2:45, Sun
ETHER:  Source      = 0:10:11:64:40:1,
ETHER:  Ethertype = 0800 (IP)
ETHER:
IP:   ----- IP Header -----         
IP:
IP:   Version = 4
IP:   Header length = 20 bytes
IP:   Type of service = 0x00
IP:         xxx. .... = 0 (precedence)
IP:         ...0 .... = normal delay
IP:         .... 0... = normal throughput
IP:         .... .0.. = normal reliability
IP:   Total length = 44 bytes
IP:   Identification = 239
IP:   Flags = 0x4
IP:         .1.. .... = do not fragment
IP:         ..0. .... = last fragment
IP:   Fragment offset = 0 bytes
IP:   Time to live = 113 seconds/hops
IP:   Protocol = 6 (TCP)
IP:   Header checksum = 88b1
IP:   Source address = abcd
IP:   Destination address = 192.195.121.7, rutherford3
IP:   No options
IP:
TCP:  ----- TCP Header -----
TCP:
TCP:  Source port = 47891
TCP:  Destination port = 36034
TCP:  Sequence number = 1345341180
TCP:  Acknowledgement number = 0
TCP:  Data offset = 24 bytes
TCP:  Flags = 0x02
TCP:        ..0. .... = No urgent pointer
TCP:        ...0 .... = No acknowledgement
TCP:        .... 0... = No push
TCP:        .... .0.. = No reset
TCP:        .... ..1. = Syn
TCP:        .... ...0 = No Fin       
TCP:  Window = 49152
TCP:  Checksum = 0x78f7
TCP:  Urgent pointer = 0
TCP:  Options: (4 bytes)
TCP:    - Maximum segment size = 1460 bytes
TCP: 

any help would be appreciated.
PS. we are using fwtk version 2.1 on a solaris 5.6 platform, our machine
sits behind a firewall.
thanks.

---

From: Ted Keller <[email-masked]>
Date: Wed, 8 Nov 2000 14:31:55 -0500 (EST)

Fernando,

Did you install the ftp-gw patch we discusses last week?

tek

---

From: "Larry Jackson" <[email-masked]>
Date: Wed, 8 Nov 2000 15:17:59 -0500

I'm not an expert, but this looks normal.
The port change should be the data channel.
Your problem probably has to do with blocked high # ports.
Check your firewall packet filters for these ports.

There is a patch to restrict the data port to a certain range.
You could enable a few and restrict ftp-gw.

Another possibility is that IIRC is that there is a problem in ftp-gw
regarding rolling back the data port when the requested one is rejected.
I think this was discussed resently, check the archive.
http://marc.theaimsgroup.com/?l=fwtk-users&w=2&r=1&s=ftp+port&q=b
or
http://marc.theaimsgroup.com/?l=fwtk-users&w=2&r=1&s=ftp+data&q=b

[email-masked]
----- Original Message -----
From: "Barreira, Fernando [IT]" <[email-masked]>