so, here is a trace done with FileZilla FTP, which works with no
problems
when FW was activated:
No. Source Destination Protocol Info
689 10.0.1.48 10.0.1.25 FTP Response: 220 dcpu1 FTP server
(Version
691 10.0.1.25 10.0.1.48 FTP Request: USER serviceuser
692 10.0.1.48 10.0.1.25 TCP ftp > 1850 [ACK] Seq=63 Ack=19 Len=0
693 10.0.1.48 10.0.1.25 FTP Response: 331 Password required for xyz
694 10.0.1.25 10.0.1.48 FTP Request: PASS xyz
695 10.0.1.48 10.0.1.25 TCP ftp > 1850 [ACK] Seq=103 Ack=41 Win=321
696 10.0.1.48 10.0.1.25 FTP Response: 230- Have a lot of fun....
703 10.0.1.25 10.0.1.48 TCP 1850 > ftp [ACK] Seq=41 Ack=131 Win=17
704 10.0.1.48 10.0.1.25 FTP Response: 230 User xyz logged in.
707 10.0.1.25 10.0.1.48 FTP Request: FEAT
708 10.0.1.48 10.0.1.25 FTP Response: 500 'FEAT': command not under
709 10.0.1.25 10.0.1.48 FTP Request: SYST
710 10.0.1.48 10.0.1.25 FTP Response: 215 UNIX Type: L8 (Linux)
711 10.0.1.25 10.0.1.48 FTP Request: PWD
712 10.0.1.48 10.0.1.25 FTP "Response: 257 ""/servdir"" is current
713 10.0.1.25 10.0.1.48 FTP Request: PORT 10,0,1,25,19,137
714 10.0.1.48 10.0.1.25 FTP Response: 200 PORT command successful.
715 10.0.1.25 10.0.1.48 FTP Request: TYPE A
716 10.0.1.48 10.0.1.25 FTP Response: 200 Type set to A.
718 10.0.1.25 10.0.1.48 FTP Request: LIST
719 10.0.1.48 10.0.1.25 TCP ftp-data > 5001 [SYN] Seq=0 Ack=0 Win=
720 10.0.1.25 10.0.1.48 TCP 5001 > ftp-data [SYN, ACK] Seq=0 Ack=1
721 10.0.1.48 10.0.1.25 TCP ftp-data > 5001 [ACK] Seq=1 Ack=1 Win=3
722 10.0.1.48 10.0.1.25 FTP Response: 150 Opening ASCII mode data c
723 10.0.1.48 10.0.1.25 FTP -DATA FTP Data: 141 bytes
724 10.0.1.48 10.0.1.25 TCP ftp-data > 5001 [FIN, ACK] Seq=142 Ack=
725 10.0.1.25 10.0.1.48 TCP 5001 > ftp-data [ACK] Seq=1 Ack=143 Win
728 10.0.1.25 10.0.1.48 TCP 5001 > ftp-data [FIN, ACK] Seq=1 Ack=1
729 10.0.1.48 10.0.1.25 TCP ftp-data > 5001 [ACK] Seq=143 Ack=2 Wi
735 10.0.1.25 10.0.1.48 TCP 1850 > ftp [ACK] Seq=95 Ack=371 Win=171
736 10.0.1.48 10.0.1.25 FTP Response: 226 Transfer complete.
745 10.0.1.25 10.0.1.48 TCP 1850 > ftp [ACK] Seq=95 Ack=395 Win=171
822 10.0.1.25 10.0.1.48 FTP Request: CWD service
823 10.0.1.48 10.0.1.25 FTP Response: 250 CWD command successful.
824 10.0.1.25 10.0.1.48 FTP Request: PWD
825 10.0.1.48 10.0.1.25 FTP "Response: 257 ""/servdir/service"" is
826 10.0.1.25 10.0.1.48 FTP Request: PORT 10,0,1,25,19,138
827 10.0.1.48 10.0.1.25 FTP Response: 200 PORT command successful.
828 10.0.1.25 10.0.1.48 FTP Request: TYPE A
829 10.0.1.48 10.0.1.25 FTP Response: 200 Type set to A.
830 10.0.1.25 10.0.1.48 FTP Request: LIST
....
991 10.0.1.48 10.0.1.25 TCP ftp-data > 5004 [SYN] Seq=0 Ack=0 Win=
992 10.0.1.25 10.0.1.48 TCP 5004 > ftp-data [SYN, ACK] Seq=0 Ack=1
993 10.0.1.48 10.0.1.25 TCP ftp-data > 5004 [ACK] Seq=1 Ack=1 Win=
994 10.0.1.48 10.0.1.25 TCP ftp > 1850 [ACK] Seq=787 Ack=240 Win=3
996 10.0.1.48 10.0.1.25 FTP Response: 150 Opening ASCII mode data c
997 10.0.1.48 10.0.1.25 FTP -DATA FTP Data: 208 bytes
998 10.0.1.48 10.0.1.25 TCP ftp-data > 5004 [FIN, ACK] Seq=209 Ack=
999 10.0.1.25 10.0.1.48 TCP 5004 > ftp-data [ACK] Seq=1 Ack=210 Win
1000 10.0.1.25 10.0.1.48 TCP 5004 > ftp-data [FIN, ACK] Seq=1 Ack=2
1001 10.0.1.48 10.0.1.25 TCP ftp-data > 5004 [ACK] Seq=210 Ack=2 Win
1002 10.0.1.25 10.0.1.48 TCP 1850 > ftp [ACK] Seq=240 Ack=842 Win
1003 10.0.1.48 10.0.1.25 FTP Response: 226 Transfer complete.
1020 10.0.1.25 10.0.1.48 TCP 1850 > ftp [ACK] Seq=240 Ack=866 Win=
1190 10.0.1.25 10.0.1.48 TCP 1850 > ftp [RST, ACK] Seq=240 Ack=866
W
The differences I noticed are, when a transfer is completed (line 1003)
first an ACK is sendet (1020) an then the RST,ACK (1190) cames along.
In the trace of the MFC FTP client ther was no ACK first, instead there
was a FIN,ACK.
Could this help to bring some light on this hidden problem?
Sebastian