ftp large files fail, small files succeed

[Ron Kaledas]

Thanks for all the input.

I have zero control or input on the network side of things at this site, I can only (try to) use what they give me. Based on what I've read here, I'll see if I can get the ports that my systems connect to set to auto-negotiate if I can. Does that apply to both duplex and speed, or are there separate auto settings for each? (I'm not a network guru!) mc lancp tells me I'm expecting 100 full on both. I can't take the prod system down to verify console settings.

fwiw, both systems are at vms 7.3-2. (upgrade is in progress to 8.3, wish I could go right to 8.4, but can't.)

[Mike Maltsman]

It is possible that FTP server closes COMMAND port 21 before closing high data port. You may try to increase timeout interval. This has it's own issues with having too many ports open in TIME_WAIT. What is interposing that you can actually still be able to transfer the file successfully even with that error.

[Jon Pinkley]

Ron,

Without more information than you have provided, all we can do is make some educated guesses.

Has ftp ever worked between these systems? If so, what has changed?

Does ftp work between other systems and the production system?

Does ftp work between other systems and the test system?

What do you mean by "I can ftp smaller files."? 1 block, 10 block, 100 blocks, 1000 blocks? Can you show us an example of what works?

If a small file works, I don't see how the problem could be related to passive mode. That only affects which side opens the data connection, and is related to firewall configurations. Using put from the other system could also test this.

We need to know how the test system is connected to the production system. Is there something more than an ethernet switch (layer 2) between the two systems; a router, firewall, NAT, VPN etc.?

A layer 2 ethernet switch isn't going to modify packets, there could be duplex mismatches, but these should be visible in the output from LANCP> show device /internal_counters.

Routers and gateways provide for many more possible failures.

PMTUD blackhole

https://supportforums.cisco.com/docs/DOC-5839;jsessionid=55857038EDD78889298385026D39F4E2.node0

Resolve IP Fragmentation, MTU, MSS, and PMTUD Issues with GRE and IPSEC (this has a lot of good technical info that applied to VPN connections, but this doesn't explain how to avoid the problems with VMS)

http://www.cisco.com/application/pdf/paws/25885/pmtud_ipfrag.pdf

If there is more than just a simple switch between the two VMS systems, you could try this to see if it makes a difference. If it doesn't, then return to previous state. You may need to apply to both sides.

The following can possibly work around a PMTUD blackhole, but it could also increase the TCP/IP overhead (since it can cause smaller packets to be sent)

Contents of SYS$COMMON:[SYSMGR]TCPIP_SYSCONFIG.COM

$ @sys$manager:tcpip$define_commands.com
$ sysconfig -r inet tcp_mssdflt=536
$ sysconfig -r inet pmtu_enabled=0
$ exit

Good luck,

Jon

[Hoff]

Call up Mike LeRoy. Explain the problem. Done.

[Ron Kaledas]

Nice thought Steve...however, this isn't at dmc, it's at another site. And, it so happens that I was on a con call with that site today, which included the CIO there, and I mentioned the problem...

it's being worked on. I don't expect much this week...

[Ron Kaledas]

As for Jon's questions - this is a new test system, that got set up for this upgrade. Also, I only have these 2 vms systems to go between.

Sorry, I don't remember the rest of your questions, but that should answer a few of them. (wish I could see the thread when I'm doing a reply!)

[Jon Pinkley]

Your original post indicates that no data was transferred in the data connection, so that makes me think it is could be related to an MTU black hole. It is possible that short packets get through, but large ones are being dropped by something in the path between the systems. If there is something blocking ICMP packets, MTU path discovery will not work.

Q1: What is the largest small file that you can successfully ftp?

Q2: Does $ ping -s 1500 10.252.18.75 work? If not what about smaller values for size, for example -s 1200? Use binary search to determine the largest packet you can get to work.

To be able to see questions while answering, cut and paste to notepad, then use notepad to edit your response, then select your response from notepad, and paste into ITRC.

Jon

[Andy Bustamante]

Ron,

You may also try traceroute with the -f flag

from a 7.3-2 system

$tcpip traceroute -f 10.92.212.57 1500
1 GATEWAY (10.40.92.1) 0.976 ms 0.976 ms 0.0 ms
2 172.20.252.6 (172.20.252.6) 0.977 ms 0.977 ms 0.976 ms
3 10.198.10.19 (10.198.10.19) 0.976 ms 0.976 ms 0.976 ms
4 10.198.10.19 (10.198.10.19) 0.977 ms (ttl=253!) !F=1412 0.976 ms (ttl=253!) !F=1412 0.977 ms (ttl=253!) !F=1412
(switching to new packet size 1412)
5 DRES40 (10.198.212.57) 1.95 ms 1.95 ms 1.95 ms

the -f is don't fragement, 1500 is packet size. There is an encrypted tunnel in the example above.

I didn't expect TCPIP to give a working MTU in one step. Kudos to the TCPIP team.

[John Gillings]

Ron,

>It seems to me - though I can't remember
>details - that auto was to be avoided
>because "things" (cisco, nics, can't
>remember what) didn't always make the right
>choice, so that's why fixed was preferred.
>Of course, this may be outdated
>information...

Very outdated! It might have been relevant last century with a limited set of very old adapters, but for at least the last 10 years, autonegotiate has worked correctly on all OpenVMS systems.

Bad things happen when one end of the link is hard set and the other end is set to auto (and since auto is an all but universal default, this happens a lot if you hard set ports anywhere). The autonegotiate end typically sets the speed correctly, but chooses half duplex. That works intermittently if the other end is set to full duplex, typically failing under load. Blame the poorly thought out autonegotiate protocol dreamt up by those who claim to be the setters of industry standards, but suffice to say that if everyone agrees to autonegotiate it will work reliably.

From a support perspective, I have a policy of checking ethernet port settings for ANY performance related issue on an OpenVMS host. I never cease to be amazed at how pervasive this configuration error could be! Anything from FTP to cluster locking and sometimes things that you'd never guess could be affected by network behaviour.

My strong recommendation is for ALL ports on ALL systems and network infrastructure for ALL operating systems to be set to autonegotiate (note that for gigabit ethernet it's mandatory - I don't know why anyone even allows for it to be turned off!).

The only good thing to say about hard setting port speeds is it keeps a lot of folk like me employed, fixing them!

[Steve Reece_3]

Stupid though it may sound, if you're stuck with FTP rather than sftp, try putting the command
ftp> hash
in before you start the transfer. It will at least tell you if there are any data going over the link. Others will confirm whether it keeps the control link alive too.

It will create lots of output though on the terminal/log file doing the transfer!

Steve