FTP hung

[tom quach_1]

Dear all,

hope that you could help me on this FTP issue.
the ftp had been working for users in a longtime. yesterday, users complanned that they could ftp to the outside ip address and got a connection but could not run any commands like "ls", "put"...
but from outsite the company i could connect and do anything to that outside ip address.
i was thinking about the firewall.
any suggestions that i can tell the network admin to check?
from inside company, even from my windows XP, using DOS to FTP to that outside ip address, it would hung if i ran " ls" or "put"...
Thank you in advance.

Regards,
Tom

[Keith Johnson]

I would ask the firewall folks to ensure that ports 20 and 21 are both opened.

[Coolmar]

The FTP Protocol requires two connections a CONTROL CHANNEL and a DATA CHANNEL. When a client connects to an FTP server (CONTROL CHANNEL), and then issues a LIST command or DIR or TRANSFER, the DATA CHANNEL is made. On ACTIVE MODE the server makes the second connection (DATA CHANNEL) back to the client. If the client is behind a firewall like a DSL router this connection attempt will fail because the router dosen't know that the client is waiting for this connection and it blocks inbound connection attempts. On PASSIVE mode the client makes the second connection to the server. So both
connections are coming from the client and the firewall (DSL router) dosen't interupt outgoing connections.

Seeing as you can make the connection, it looks as though the CONTROL CHANNEL is opened but looks like the DATA CHANNEL is not. I would check with the firewall folks.

[spex]

Hi Tom,

I'm not sure I see the point of connecting to your outside IP address from within your network. If it's because you'd like to make the IP address consistent from inside and outside, you might consider DNS as an alternative. Personally, I would have users on the LAN connect to the internal address.

This definitely seems like a firewall and/or routing problem.

PCS

[tom quach_1]

Thank you Keith,Coolmar and spex for the infor.
so it seems like the control channel using port 21 and data channel using port 20 ?

one addition information.
after making a connection to the ftp server.
i could do "pwd", cd ../ or down and that was about it.
nothing else.
Would you think the data channel not open at that time.
Regrards,
Tom

ps
Thanks Coolmar for this information.

[Keith Johnson]

Yes, 20 is the data channel and 21 is the control channel. And yes, if the data channel is not open you will not be able to get or put files, do an ls, etc.

[Michael Steele_2]

Dear Tom:

A) Not the subnet of the outside ip address that you're trying to reach. Can you get to a workstation within that subnet and ftp?

B) Use 'telnet ip.address port#' to establish a firewall block on a port. You should get CONNECTED.

# telnet 10.23.45.122 21
CONNECTED!

[Michael Steele_2]

Dear Tom:

A) Note the subnet of the outside ip address that you're trying to reach. Can you get to a workstation within that subnet and ftp now?

B) Use 'telnet ip.address port#' to determine a firewall block on a port. You should get CONNECTED if not blocked; hanging if blocked.

# telnet 10.23.45.122 21
CONNECTED!

[tom quach_1]

Thank Michael,

telnet to the ip and port 21 is fine
# telnet 10.23.45.122 21
CONNECTED!

i was thinking about port 20 on my site
how can i check that port ?

Regards,
Tom

[tom quach_1]

Dear all,
hope you could give me some advice on this.
talked to people who control FTP server and they said the client determined the mode that it could connect.
so we added the PASS (passive mode) to the script and it was able to transfer file.
any idea? it was working fine before without adding PASS to the script.



#/bin/sh -x
ftp -i -n << EOJ
open 192.168.120.200
user xxxx xxxxxxxx
PASS
lcd /XXX/XXXX/XXXX/XXXXX
put $XXXX
quit
EOJ


Thanks,
Tom

[Coolmar · Accepted solution]

On PASSIVE mode the client makes the second connection to the server. So both
connections are coming from the client and the firewall (DSL router) dosen't interupt outgoing connections.


Sounds to me like something changed at the firewall and PASS is your way around it.

[Coolmar]

Check this out:

http://searchnetworking.techtarget.com/sDefinition/0,290660,sid7_gci512897,00.html

[tom quach_1]

Thank you all for your help.

Regards,
TOm