Mozilla & ftp
Rahul Sawarkar
1. The iis logs show errors 426 - connection aborted - this typically happens because of a
nework device in the middle creating havoc with your connection
2. the packet decodes tell me the following:
a. Bulk of the ftp traffic appears to move in direction
192.168.0.4 -> 192.168.0.3, so I assumed the .4 address is the server
b. However my dns query says 24.118.210.186 is pennsive.com, so this should be NATted
to the .04 address - but in the decode I see traffic from 24.118.210.186 to
192.168.0.4:21(ftp control port) er... eh?
c. We have traffic from a public ip address (24.118) to a private one (192.168..)?!!
Is both source-nat and destination-nat enabled on your router? I gotta see the tracert
output from your client on the lan to ftp://pennsive.com ..
3. I posted some crap about ftp connections last time.. my sincere apologies, a correction
is posted on the news site. I dunno what I was thinking... (or if I was thinking when I
wrote that...) its been a while since I last thought "ftp ...". To sum up
1. In active mode the client connects from a random unprivileged port n > 1024 to the
server's port 21. The client then sends the FTP command PORT n+1 to the server. The server
connects back to the client's n+1 port from port 20.
2. In passive mode the client initiates two connections to the server, the first to port
21 of the server. Then the client issues the "passive" command, on which the server opens
a random unprivileged port > 1024 and sends the info back to the client. The client then
initiates a 2nd connection from port to this port on the server.
So you need to enable the firewall on your ftp server to allow connections from "anywhere"
to any unprivileged port on the server in order for passive ftp to work, and for active
ftp you need to allow incoming connections on port 21 into the server from "anywhere", and
allow outgoing connections from port 20 of the server to "anywhere". If there is
firewall on the client side you need to allow connections from "anywhere" port 20 to your
internal ip clients.
Leavin aside the confusion about the decode... it also told me that lot of tcp segments
were not "acked" and these happended to be for connections above the well known port
range.. so I'm wondering if this is a problem with firewall and passive ftp? I also
happened to find out that IE can do both active & passive ftp with the following:
"To change the Internet Explorer FTP client mode:
1. Start Internet Explorer.
2. Click Internet Options on the Tools menu.
3. Click the Advanced tab.
4. Click Enable Folder View for FTP sites.
Internet Explorer is an Active mode FTP client when you select the Enable Folder View for
FTP sites option (no matter what the Use Passive FTP Option says).
Internet Explorer can be enabled for a passive mode FTP client when you clear this option"
Which is what you might have working for you with IE. Try disabling active mode in IE and
test both internal & wan connections.
Mozilla as you said does not appear to have this switch, so maybe it only works in
"passive" mode and if your firewall/nat is not well configured, it may cause the
connection to fail in the passive phase after the initial connection and timeout....
Rgrds