ftp issue

[Allen DuBeau]

We have an appliaction that uses a ftp script to transfer file to a remote site at a vendors location. Up until 2 weeks ago this ftp script worked fine with out any issues and has been for the past 4 yrs according to the app support team. and here is what we are experiencing:

An ftp session will start for a file transfer annd will run fine for about 10 to 20 minutes then all of a sudden start sending response packets to the receiving node - this storm is so bad that it brings the receiving nodes network to a halt, thus forcing the vendor to block our IP at the fire wall..

Network teams from both companies are unable to actually determine what is causing the storm by analyzing the network traffic, except to say they see lots of ACK's and Responses going accross. The receving machine is a windows 2003 server running wu-ftpd.

Now we are noticing that we are experiencing the issue on a UNIX to UNIX when ftp'ing files and since we have no idea as to waht is causing the issue we have to reboot the systems inorder to resolve the problem...

If anyone has experienced a simiular situation and could provide details as to what was doen to fix it or has suggestions I would appreciate it...

The UNIX system is running 11i on a N-class system....

Regards,

Allen

[RAC_1]

first thing is enable inetd logging and ftpd logging. (ftpd -l)

Now what does syslog say??

[Doug O'Leary]

Hey, Allen;

I was fighting a similar issue on one of the new boxes. To verify network traffic, we temporarily loaded tcpdump and grabbed any/all packets between the two systems. That helped verify the initial connection which got the network team onto the right track. We then unloaded tcpdump. Although it's a really useful tool for administrators, it's also an unholy information gathering tool for black-hats.

We could do the same here; load tcpdump and monitor the network traffic through the problem. That would tell us exactly what each sysem was sending/receiving and, hopefully, exactly what was causing the problem.

Without that information, we're pretty much grasping at straws. Just from the description, it sounds like a patch issue. There were a number of Windows patches that came out about 1-2 weeks ago; however, if the N box is having problems with multiple systems, I'd have to think the source of the problem is there. Was that system patched recently?

Let me know if you'd like Marvin or me to help out...

Doug

[Geoff Wild]

In your script, do you set PASV mode?

Rgds...Geoff

[Dave La Mar]

Allen -
I agree with Geof's note as this was an issue in our shop as well.
On another note, has the Windows receiving machine changed. I remember, many years back, an MTU setting on a windows box causing issues.

Best of luck.

Regards,

-dl

[baiju_3]

We had a similar problem in the past .Same case with one side windows and other HP.

Automatic ftp script used to hang in between that too once in a day .

We used tcpdump utility to analyse the packates also enabled tracing on PIX fire wall and found that the PIX is getting loaded and the ftp session was not receiving a ACK from our ftp server with number of unwatned connections which was originating from some VM Ware Server Servers at Our premise .Once those servers were disconnected every thing came normal .

Suggest you to download and installk tcpdump and analyse the traffic .



Thanks,
BL.