SYSLOG: ttloop: peer died - FTP problem

[Robert Hoey]

Hello all,

Last week we had a situation where no one could ftp to both of our systems. This lasted a couple of hours and them it worked just fine. I was not onsite that day, so I didn't get a chance to view the systems as everything was happening. The only thing that I have to go by is syslog.

We are using wu-ftp 2.6.1.

During the two hours that ftp was not working, the following messages occur in syslog:

Nov 21 15:07:19 vak580 telnetd[8043]: ttloop: peer died: Connection refused
Nov 21 15:08:47 vak580 telnetd[8059]: ttloop: peer died: Connection refused
Nov 21 15:15:43 vak580 telnetd[8113]: ttloop: read: Connection reset by peer
Nov 21 15:17:15 vak580 telnetd[8518]: ttloop: peer died: Connection refused
Nov 21 15:17:26 vak580 telnetd[29492]: recv: Connection timed out
Nov 21 15:58:38 vak580 telnetd[23286]: recv: Connection timed out
Nov 21 16:04:14 vak580 telnetd[3574]: recv: Connection reset by peer
Nov 21 16:04:38 vak580 telnetd[29362]: recv: Connection reset by peer

What do they all mean?

[Robert Hoey]

Please ignore this incomplete posting.

Thanks.
-Rob

[Uday_S_Ankolekar]

Hi,

This may be due to a duplicate IP address, DNS being down and in most cases this could happen at the firewall.

Check the nettl log for duplicates

#netfmt -f /var/adm/nettl.LOG00 > /tmp/logfile
#more logfile

The ttloop is part of the telnet code.

Goodluck,
-USA..

[Sanjay_6]

Hi Robert,

Take a look at the thread below,

http://us-support2.external.hp.com/cki/bin/doc.pl/sid=1963a2810358c9b405/screen=ckiDisplayDocument?docId=200000055045873

Hope this helps.

Regds

[Rita C Workman]

Well actually your telnet errors are telling you a couple different issues..
First....
telnet refused, tells you that you made the connection but the other host said..nope. This could be because of security, your shell or more than likely you ran short on your npty parms. I recommend increasing the npty and nsptry parms. These take so little in resources you can up this without feeling any pain.
Second....
telnet, peer died. Now this is probably a time out on resolution. You may want to check your ~resolv.conf file...or...if using DNS than you may want to add something to your named.boot file...or if your resolving via /etc/hosts than you might want to add the user IP in there...otherwise when they go to telnet in from a PC it will hang trying to resolve..and you can timeout.

Just a thought,
Rit

[Robert Hoey]

Here's some more info:
This happens to two machines at the same time (both on the same segment, X.X.144.17 and X.X.144.18).
You can't FTP to them and it takes well over two minutes to connect via telnet. Once you connect via telnet, you see no problems (speed wise).
The hub they are connected to is okay.
We are using IP addresses to connect, so DNS is not involved.
Both machines use /etc/hosts to resolve first, then DNS (if necessary).
All connections as well as the DNS machine are local/internal to our company so there is no firewall to be concerned with.

The problem just occured again in our machines. This is the second time...the first time was on Nov 21.

It seems that it gets the following message in syslog just before we notice the problem:
Nov 30 14:45:43 vad390 ftpd[24272]: FTP session closed

Also, you can not find where this FTP session was opened in syslog. There are usually multiple "FTP session closed" messages that do not coincide with an "FTP LOGIN" message.

nettl was never configured and started on either machine so nothing has been logged with that utility. I started nettl on one machine this morning, but nothing was written to /var/adm/nettl.LOG00.

Any other directions that you can point me in?

Thanks in advance.
-rob

[Sanjay_6]

Hi Robert,

Take a look at the threads below,

http://us-support2.external.hp.com/cki/bin/doc.pl/sid=7a73c007114762d3f0/screen=ckiDisplayDocument?docId=200000055386771

http://us-support2.external.hp.com/cki/bin/doc.pl/sid=546f6ec617eec0086b/screen=ckiSearchResults?mode=id&searchString=HONCIKKBRC00000167

http://us-support2.external.hp.com/cki/bin/doc.pl/sid=564fbe4d115faff253/screen=ckiDisplayDocument?docId=200000052195845

If you want to download "lsof" and try, check this site,

http://www-rcd.cc.purdue.edu/~abe/

Here is the "lsof" faq,

ftp://vic.cc.purdue.edu/pub/tools/unix/lsof/FAQ

Hope this helps.

Regds

[Robert Hoey]

I've tried lsof and have found nothing out of the ordinary. I checked out the kernel parameters and all are large enough to take on the limited number of users on our system. Also, I checked out all of the links that you have all sent and none of them directly apply to my situation.

Any other ideas??

Thanks for the help so far.
-Rob

[Sanjay_6]

Hi Robert,

Try this link,

http://us-support3.external.hp.com/cki/bin/doc.pl/sid=3a4c635716e553ae32/screen=ckiDisplayDocument?docId=200000055045873

Also, try and see if you do a ftp manually from the remote box without using wu-ftp.

Hope this helps.

Regds

[Roger Baptiste]

hi,

You mentioned FTP , but the syslog error messages relate to telnetd !!.

Next, during the time FTP was not working, were you able to use telnet or rlogin ?
If so, then this is a "ftp"
issue and not a network or DNS issue.

You said, you are using wuftp . Was this reconfigured recently?
Try using the native FTP which comes with the system and see whether it works.

Enable logging on syslogd
(run inetd with -l option) and check the syslog.log file, as you try ftp.

ANother suggestion, try ftp ing into the same box and see how it responds.

HTH
raj