FTP literal port command getting changed

[Ben Dehner]

I am trying to write my own ftp client, and I discovered the following idiosyncrasy on Windows.

First, a digression on the FTP protocol. For an "active" type ftp session, which is the default, for transferring data the ftp client sends a port address to the FTP server, and the server opens a socket back to the client at the specified address. The format of the command is

PORT aa,bb,cc,dd,ee,dd

where aa,bb,cc,dd are the octets of the IP address and ee,dd are the octets of the port. So, if my client was 192.168.124.1 and the port I was using was 2561, I would send

PORT 192,168,124,1,10,1

With a windows FTP client, this command can be sent manually by using the "literal" keyword, as

--
ftp> literal PORT 192,168,124,1,10,1
200 PORT command successful
--

Here's the problem: on certain Windows 2003 systems, the value of the PORT argument is getting changed. If I do a network sniff of the FTP session, I see the following:

--
PORT ww,xx,yy,zz,19,137
PORT ww,xx,yy,zz,19,138
PORT ww,xx,yy,zz,19,139
--

No matter what ports I specify, or what interface I use to specify them (FTP client or custom program) the values that get sent over the network start at 5001 and increment upwards. Sometimes it will skip a value if the port seems to be in use. I cannot find any documentation of this behavior anywhere. There is no proxy software installed on this system that I can find.

The only system that I have observed this on is a Windows 2003 server (32-bit) running IIS 6, with updates as of about October '06. I've tried it on Win2k systems, Win2k3 systems without IIS, and one Win2k3 system with IIS6 but older updates.

This breaks my FTP client, because I have to open a socket and do a bind() on a port, then tell the remote FTP server about it. If the port address that I am sending gets changed in transit, then it will come back on a different port and the connection will fail.