Subject: RE: ftp-gw not passing "Fin=1" for data

From: "Barreira, Fernando [IT]" <[email-masked]>
Date: Wed, 20 Dec 2000 15:12:39 -0500

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

tony,
it looks like the fwtk machine aknowledges the fin but the remote end sends
2 packets one after the other and the second packet has "\r\n5DTD1115WA0106
" in the FTP-DATA field, this second packet looks like a retransmission of
the previous one (same seq and ack numbers) but has Push=1 not Fin=1. 

here is the entire TCP capture for the data transfer session when it hungs,
(the fwtk machine has the source port=34223, the remote site
ftp1.lewcosec.com port=20), i only include the flags that are equal to 1,
also the fwtk is not filtering any packets.

Source port = 20
TCP:  Destination port = 34223
TCP:  Sequence number = 347512880
TCP:  Acknowledgement number = 0
TCP:        .... ..1. = Syn
TCP:  Window = 17520 

TCP:  Source port = 34223
TCP:  Destination port = 20 (FTP-DATA)
TCP:  Sequence number = 2001988995
TCP:  Acknowledgement number = 347512881
TCP:        ...1 .... = Acknowledgement
TCP:        .... ..1. = Syn
TCP:  Window = 8760      

TCP:  Source port = 20
TCP:  Destination port = 34223
TCP:  Sequence number = 347512880
TCP:  Acknowledgement number = 0
TCP:        .... ..1. = Syn
TCP:  Window = 17520

TCP:  Source port = 34223
TCP:  Destination port = 20 (FTP-DATA)
TCP:  Sequence number = 2001988996
TCP:  Acknowledgement number = 347512881
TCP:        ...1 .... = Acknowledgement
TCP:  Window = 8760

TCP:  Source port = 34223
TCP:  Destination port = 20 (FTP-DATA)
TCP:  Sequence number = 2001988995
TCP:  Acknowledgement number = 347512881
TCP:        ...1 .... = Acknowledgement
TCP:  Window = 8760

Source port = 20
TCP:  Destination port = 34223
TCP:  Sequence number = 347512881
TCP:  Acknowledgement number = 2001988996
TCP:        ...1 .... = Acknowledgement
TCP:  Window = 17520

Source port = 20
TCP:  Destination port = 34223
TCP:  Sequence number = 347512881
TCP:  Acknowledgement number = 2001988996
TCP:        ...1 .... = Acknowledgement
TCP:  Window = 17520

Source port = 34223
TCP:  Destination port = 20 (FTP-DATA)
TCP:  Sequence number = 2001988996
TCP:  Acknowledgement number = 347514341
TCP:        ...1 .... = Acknowledgement
TCP:  Window = 8760

TCP:  Source port = 20
TCP:  Destination port = 34223
TCP:  Sequence number = 347515423
TCP:  Acknowledgement number = 2001988996
TCP:        ...1 .... = Acknowledgement
TCP:        .... ...1 = Fin
TCP:  Window = 17520

Source port = 20
TCP:  Destination port = 34223
TCP:  Sequence number = 347514341
TCP:  Acknowledgement number = 2001988996
TCP:        ...1 .... = Acknowledgement
TCP:        .... 1... = Push
TCP:  Window = 17520
FTP-DATA:  ----- FTP-DATA:   -----
FTP-DATA:
FTP-DATA:  "              \r\n5DTD1115WA0106 "

 Source port = 34223
TCP:  Destination port = 20 (FTP-DATA)
TCP:  Sequence number = 2001988996
TCP:  Acknowledgement number = 347515423
TCP:        ...1 .... = Acknowledgement
TCP:  Window = 8760

> ----------
> From: 	Tony Gale[SMTP:[email-masked]]
> Sent: 	Tuesday, December 19, 2000 12:08 PM
> To: 	Barreira, Fernando [IT]
> Cc: 	[email-masked]
> Subject: 	RE: ftp-gw not passing "Fin=1" for data
> 
> 
> The kernel should set the state to CLOSE_WAIT if it had "seen" a fin
> (and ack'ed it) from the remote end and was waiting for ftp-gw to
> close it's end. Does it ack the fin?
> 
> Does the fwtk server have any packet filtering turned on?
> 
> -tony
> 
> 
> On 19-Dec-2000 Barreira, Fernando [IT] wrote:
> > tony,
> > 
> > when i do a netstat on the fwtk machine, both the control and data
> > sessions
> > remain active between the (ftp-gw and client) and (ftp-gw and
> > server), pls
> > take a look:
> > 
> > (ftp-gw to client)
> > ftpproxy03.ftp       172.16.53.131.2808    7890      0  8760      0
> > ESTABLISHED
> > ftpproxy03.48327     172.16.53.131.2809    7678      0  8760      0
> > ESTABLISHED
> > 
> > (ftp-gw to server)
> > ftpproxy03.48325     ftp1.lewcosec.com.ftp 17446      0  8760     
> > 0
> > ESTABLISHED
> > ftpproxy03.48326     ftp1.lewcosec.com.ftp-data 17520      0  8760 
> > 0
> > ESTABLISHED 
> > 
> > on the client side it apears the connection stays hung because the
> > ftp
> > prompt comes back only after about 8 minutes when the control
> > session times
> > out and the following messages is displayed:
> > 200 PORT command successfull.
> > 150 Opening BINARY mode data connection for kimtest (2542 bytes)
> > -> ftp get:connection timed out
> > 
> > also why does the ftp-gw use a ramdom port other than 20 for the
> > ftp-data
> > connection to the client?
> > 
> > any feedback is appreciated. thanks.
> > 
> >> ----------
> >> From:        Tony Gale[SMTP:[email-masked]]
> >> Sent:        Tuesday, December 19, 2000 11:09 AM
> >> To:  Barreira, Fernando [IT]
> >> Cc:  [email-masked]
> >> Subject:     RE: ftp-gw not passing "Fin=1" for data
> >> 
> >> 
> >> Could you do a netstat and see what state the sockets are in for
> >> the
> >> connections concerned.
> >> 
> >> -tony
> >> 
> >> 
> >> 
> >> On 19-Dec-2000 Barreira, Fernando [IT] wrote:
> >> > [To be removed from this list send the message "unsubscribe
> >> > fwtk-users" in the
> >> > BODY of a mail message to [email-masked].]
> >> > 
> >> > hi there,
> >> > 
> >> > i have a machine running fwtk 2.1 on a solaris 5.6 platform, we
> >> > have a
> >> > problem when we try getting files from a particular ftp site. 
> >> > when
> >> > we issue
> >> > the "get" command, the session appears to hung (we never get the
> >> > ftp prompt
> >> > back).
> >> > 
> >> > after looking into some data that i captured, i verified that
> >> > fwtk
> >> > gets the
> >> > Fin=1 from the remote ftp site (server) but never passes it to
> >> > the
> >> > ftp
> >> > client, thus the client keeps the data session open until the
> >> > control
> >> > session expires and we get disconnected.
> >> > we only have this problem with this particular site
> >> > ftp1.lewcosec.com
> >> > 
> >> > 
> >> > does anybody have experienced a similar situation and have a
> >> > workaround for
> >> > this?
> >> > thanks.
> >> 
> >> ---
> >> E-Mail: Tony Gale <[email-masked]>
> >> If wishes were horses, then beggars would be thieves.
> >> 
> >> The views expressed above are entirely those of the writer
> >> and do not represent the views, policy or understanding of
> >> any other person or official body.
> >> 
> 
> ---
> E-Mail: Tony Gale <[email-masked]>
> The truth is rarely pure, and never simple.
> 		-- Oscar Wilde
> 
> The views expressed above are entirely those of the writer
> and do not represent the views, policy or understanding of
> any other person or official body.
>