The macosxhints Forums - ::: MacOSX and Active-FTP server issue :::

The macosxhints Forums (http://hintsforums.macworld.com/index.php)

- Networking (http://hintsforums.macworld.com/forumdisplay.php?f=14)

- - ::: MacOSX and Active-FTP server issue ::: (http://hintsforums.macworld.com/showthread.php?t=14175)

Somebody using a Linux box is having the same problem at :

http://www.linuxquestions.org/questi...003/03/1/48062

Regards,

Eric a.k.a. TaKeo

Interesting that a linux users is seeing the same thing, may be another indication it is firewall or something.

I see that your box is trying to open a connection to the second port on the server, but it does not look like it is happening. I should asked you to do this the first time, but can you repeat that tcp dump with:

Code:

sudo tcpdump host ftp.seguinlabelle.com

So we see both side of the conversation....

Edit: corrected command line

Damn, just when I think I understand something, it comes back and bites me. The trace of mine below seems to show that my system tries to open a port to the server (server port 1942), probably times out, and then I see the server open a port back to me(59227 !) which should not happen due to my router.

Code:

08:57:14.129917 strider.59223 > ip240.cactuscom.com.1942: S 2102151341:2102151341(0) win 65535 <mss 1452> (DF)

08:57:26.131393 strider.59223 > ip240.cactuscom.com.1942: S 2102151341:2102151341(0) win 65535 <mss 1452> (DF)

08:57:50.134751 strider.59223 > ip240.cactuscom.com.1942: S 2102151341:2102151341(0) win 65535 <mss 1452> (DF)

08:58:08.137832 strider.59222 > ip240.cactuscom.com.ftp: P 53:79(26) ack 303 win 32940 <nop,nop,timestamp 3623283985 57983245> (DF) [tos 0x10] 

08:58:08.431090 ip240.cactuscom.com.ftp > strider.59222: P 303:333(30) ack 79 win 64161 <nop,nop,timestamp 57983994 3623283985> (DF)

08:58:08.431258 strider.59222 > ip240.cactuscom.com.ftp: . ack 333 win 32936 <nop,nop,timestamp 3623283985 57983994> (DF) [tos 0x10] 

08:58:08.436584 strider.59222 > ip240.cactuscom.com.ftp: P 79:85(6) ack 333 win 32940 <nop,nop,timestamp 3623283985 57983994> (DF) [tos 0x10] 

08:58:08.733331 ip240.cactuscom.com.ftp-data > strider.59227: S 2159696618:2159696618(0) win 64240 <mss 1452,nop,nop,sackOK> (DF)

08:58:08.733564 strider.59227 > ip240.cactuscom.com.ftp-data: S 2792738159:2792738159(0) ack 2159696619 win 65535 <mss 1452> (DF)

08:58:08.741611 ip240.cactuscom.com.ftp > strider.59222: P 333:386(53) ack 85 win 64155 <nop,nop,timestamp 57983997 3623283985> (DF)

08:58:08.741717 strider.59222 > ip240.cactuscom.com.ftp: . ack 386 win 32933 <nop,nop,timestamp 3623283986 57983997> (DF) [tos 0x10] 

08:58:09.017405 ip240.cactuscom.com.ftp-data > strider.59227: . ack 1 win 65340 (DF)

08:58:09.085780 ip240.cactuscom.com.ftp-data > strider.59227: P 1:328(327) ack 1 win 65340 (DF)

08:58:09.085919 strider.59227 > ip240.cactuscom.com.ftp-data: . ack 328 win 65535 (DF) [tos 0x8] 

08:58:09.086963 ip240.cactuscom.com.ftp-data > strider.59227: F 328:328(0) ack 1 win 65340 (DF)

08:58:09.087037 strider.59227 > ip240.cactuscom.com.ftp-data: . ack 329 win 65535 (DF) [tos 0x8] 

08:58:09.090109 ip240.cactuscom.com.ftp > strider.59222: P 386:410(24) ack 85 win 64155 <nop,nop,timestamp 57984001 3623283986> (DF)

08:58:09.090194 strider.59222 > ip240.cactuscom.com.ftp: . ack 410 win 32937 <nop,nop,timestamp 3623283986 57984001> (DF) [tos 0x10] 

08:58:09.092935 strider.59227 > ip240.cactuscom.com.ftp-data: F 1:1(0) ack 329 win 65535 (DF) [tos 0x8] 

08:58:09.393404 ip240.cactuscom.com.ftp-data > strider.59227: . ack 2 win 65340 (DF)

08:58:16.968684 strider.59222 > ip240.cactuscom.com.ftp: P 85:91(6) ack 410 win 32940 <nop,nop,timestamp 3623284002 57984001> (DF) [tos 0x10] 

08:58:17.261585 ip240.cactuscom.com.ftp > strider.59222: P 410:417(7) ack 91 win 64149 <nop,nop,timestamp 57984082 3623284002> (DF)

08:58:17.261754 strider.59222 > ip240.cactuscom.com.ftp: . ack 417 win 32939 <nop,nop,timestamp 3623284003 57984082> (DF) [tos 0x10] 

08:58:17.264756 strider.59222 > ip240.cactuscom.com.ftp: F 91:91(0) ack 417 win 32940 <nop,nop,timestamp 3623284003 57984082> (DF) [tos 0x10] 

08:58:17.265561 ip240.cactuscom.com.ftp > strider.59222: F 417:417(0) ack 91 win 64149 <nop,nop,timestamp 57984082 3623284002> (DF)

08:58:17.265641 strider.59222 > ip240.cactuscom.com.ftp: F 91:91(0) ack 418 win 32940 <nop,nop,timestamp 3623284003 57984082> (DF) [tos 0x10] 

08:58:17.553715 ip240.cactuscom.com.ftp > strider.59222: . ack 92 win 64149 <nop,nop,timestamp 57984085 3623284003> (DF)

I will do some more research on this one....

OK, apparently my router realizes that this is an active outbound ftp connection and allows the server's connection back in.

TaKeo, maybe your router (or your clients) do not do this (but why does OS9 work)? It still might be worth seeing the tcpdump of traffic in both directions.

I must admit I was surprised mine did this. I really expected an active connection to fail for me.

Quote:

In article <XZV2b.65973$bo1.59846@news-server.bigpond.net.au>, Jeff Fulton <jefff@fulton.net.au> wrote:

> The router has special code to handle outbound active mode ftp connections.
> It inspects the outbound port command and automatically opens the
> appropriate port for the incoming data connection.
>
> The filter rule that you showed is for the control connection (21) not the
> data connection (from remote 20), so wouldn't apply even if active.
>
> Regards
> Jeff Fulton
> www.fulton.net.au

Here's what i got by doing

-------------------

% sudo tcpdump host ftp.seguinlabelle.com
Password:
tcpdump: listening on en0
08:25:46.250576 192.168.0.4.52430 > ip240.cactuscom.com.ftp: S 3492907941:3492907941(0) win 32768 <mss 1460,nop,wscale 0,nop,nop,timestamp 1834564864 0> (DF)
08:25:46.299424 ip240.cactuscom.com.ftp > 192.168.0.4.52430: S 1991559605:1991559605(0) ack 3492907942 win 64240 <mss 1432,nop,wscale 0,nop,nop,timestamp 0 0> (DF)
08:25:46.299485 192.168.0.4.52430 > ip240.cactuscom.com.ftp: . ack 1 win 34080 <nop,nop,timestamp 1834564864 0> (DF)
08:25:46.349803 ip240.cactuscom.com.ftp > 192.168.0.4.52430: P 1:52(51) ack 1 win 64240 <nop,nop,timestamp 58468550 1834564864> (DF)
08:25:46.483350 192.168.0.4.52430 > ip240.cactuscom.com.ftp: . ack 52 win 34080 <nop,nop,timestamp 1834564864 58468550> (DF) [tos 0x10]
08:25:51.844281 192.168.0.4.52430 > ip240.cactuscom.com.ftp: P 1:14(13) ack 52 win 34080 <nop,nop,timestamp 1834564875 58468550> (DF) [tos 0x10]
08:25:51.893688 ip240.cactuscom.com.ftp > 192.168.0.4.52430: P 52:87(35) ack 14 win 64227 <nop,nop,timestamp 58468605 1834564875> (DF)
08:25:52.083795 192.168.0.4.52430 > ip240.cactuscom.com.ftp: . ack 87 win 34080 <nop,nop,timestamp 1834564875 58468605> (DF) [tos 0x10]
08:25:53.180616 192.168.0.4.52430 > ip240.cactuscom.com.ftp: P 14:24(10) ack 87 win 34080 <nop,nop,timestamp 1834564878 58468605> (DF) [tos 0x10]
08:25:53.247500 ip240.cactuscom.com.ftp > 192.168.0.4.52430: P 87:115(28) ack 24 win 64217 <nop,nop,timestamp 58468619 1834564878> (DF)
08:25:53.248717 192.168.0.4.52430 > ip240.cactuscom.com.ftp: P 24:30(6) ack 115 win 34080 <nop,nop,timestamp 1834564878 58468619> (DF) [tos 0x10]
08:25:53.302550 ip240.cactuscom.com.ftp > 192.168.0.4.52430: P 115:143(28) ack 30 win 64211 <nop,nop,timestamp 58468620 1834564878> (DF)
08:25:53.304354 192.168.0.4.52430 > ip240.cactuscom.com.ftp: P 30:36(6) ack 143 win 34080 <nop,nop,timestamp 1834564878 58468620> (DF) [tos 0x10]
08:25:53.353697 ip240.cactuscom.com.ftp > 192.168.0.4.52430: P 143:179(36) ack 36 win 64205 <nop,nop,timestamp 58468620 1834564878> (DF)
08:25:53.355127 192.168.0.4.52430 > ip240.cactuscom.com.ftp: P 36:41(5) ack 179 win 34080 <nop,nop,timestamp 1834564878 58468620> (DF) [tos 0x10]
08:25:53.404732 ip240.cactuscom.com.ftp > 192.168.0.4.52430: P 179:216(37) ack 41 win 64200 <nop,nop,timestamp 58468621 1834564878> (DF)
08:25:53.484023 192.168.0.4.52430 > ip240.cactuscom.com.ftp: . ack 216 win 34080 <nop,nop,timestamp 1834564878 58468621> (DF) [tos 0x10]
08:26:01.205011 192.168.0.4.52430 > ip240.cactuscom.com.ftp: P 41:47(6) ack 216 win 34080 <nop,nop,timestamp 1834564894 58468621> (DF) [tos 0x10]
08:26:01.254114 ip240.cactuscom.com.ftp > 192.168.0.4.52430: P 216:252(36) ack 47 win 64194 <nop,nop,timestamp 58468699 1834564894> (DF)
08:26:01.260382 192.168.0.4.52430 > ip240.cactuscom.com.ftp: P 47:53(6) ack 252 win 34080 <nop,nop,timestamp 1834564894 58468699> (DF) [tos 0x10]
08:26:01.309957 ip240.cactuscom.com.ftp > 192.168.0.4.52430: P 252:303(51) ack 53 win 64188 <nop,nop,timestamp 58468700 1834564894> (DF)
08:26:01.313537 192.168.0.4.52431 > ip240.cactuscom.com.2159: S 3102587044:3102587044(0) win 32768 <mss 1460,nop,wscale 0,nop,nop,timestamp 1834564894 0> (DF)
08:26:01.484565 192.168.0.4.52430 > ip240.cactuscom.com.ftp: . ack 303 win 34080 <nop,nop,timestamp 1834564894 58468700> (DF) [tos 0x10]
08:26:04.088135 192.168.0.4.52431 > ip240.cactuscom.com.2159: S 3102587044:3102587044(0) win 32768 <mss 1460,nop,wscale 0,nop,nop,timestamp 1834564899 0> (DF)
08:26:07.088352 192.168.0.4.52431 > ip240.cactuscom.com.2159: S 3102587044:3102587044(0) win 32768 <mss 1460,nop,wscale 0,nop,nop,timestamp 1834564905 0> (DF)
08:26:10.088522 192.168.0.4.52431 > ip240.cactuscom.com.2159: S 3102587044:3102587044(0) win 32768 <mss 1460> (DF)
08:26:13.088676 192.168.0.4.52431 > ip240.cactuscom.com.2159: S 3102587044:3102587044(0) win 32768 <mss 1460> (DF)
08:26:16.088847 192.168.0.4.52431 > ip240.cactuscom.com.2159: S 3102587044:3102587044(0) win 32768 <mss 1460> (DF)
08:26:22.089235 192.168.0.4.52431 > ip240.cactuscom.com.2159: S 3102587044:3102587044(0) win 32768 <mss 1460> (DF)
08:26:34.089631 192.168.0.4.52431 > ip240.cactuscom.com.2159: S 3102587044:3102587044(0) win 32768 <mss 1460> (DF)
08:26:58.090452 192.168.0.4.52431 > ip240.cactuscom.com.2159: S 3102587044:3102587044(0) win 32768 <mss 1460> (DF)
08:27:16.091206 192.168.0.4.52430 > ip240.cactuscom.com.ftp: P 53:79(26) ack 303 win 34080 <nop,nop,timestamp 1834565044 58468700> (DF) [tos 0x10]
08:27:17.591019 192.168.0.4.52430 > ip240.cactuscom.com.ftp: P 53:79(26) ack 303 win 34080 <nop,nop,timestamp 1834565046 58468700> (DF) [tos 0x10]
08:27:20.591171 192.168.0.4.52430 > ip240.cactuscom.com.ftp: P 53:79(26) ack 303 win 34080 <nop,nop,timestamp 1834565052 58468700> (DF) [tos 0x10]
08:27:26.591495 192.168.0.4.52430 > ip240.cactuscom.com.ftp: P 53:79(26) ack 303 win 34080 <nop,nop,timestamp 1834565064 58468700> (DF) [tos 0x10]
08:27:38.591866 192.168.0.4.52430 > ip240.cactuscom.com.ftp: P 53:79(26) ack 303 win 34080 <nop,nop,timestamp 1834565088 58468700> (DF) [tos 0x10]
08:28:02.592603 192.168.0.4.52430 > ip240.cactuscom.com.ftp: P 53:79(26) ack 303 win 34080 <nop,nop,timestamp 1834565136 58468700> (DF) [tos 0x10]
08:28:16.090486 192.168.0.4.52430 > ip240.cactuscom.com.ftp: F 79:79(0) ack 303 win 34080 <nop,nop,timestamp 1834565163 58468700> (DF) [tos 0x10]
08:28:16.138659 ip240.cactuscom.com.ftp > 192.168.0.4.52430: . ack 53 win 64188 <nop,nop,timestamp 58470048 1834564894> (DF)
08:28:34.593517 192.168.0.4.52430 > ip240.cactuscom.com.ftp: FP 53:79(26) ack 303 win 34080 <nop,nop,timestamp 1834565200 58470048> (DF) [tos 0x10]

--------------------

Just a reminder, somebody else from the office can't also connect to our ftp server. No firewall, no router. Straight connection.

Something weird here...

other than that...well i love Jaguar, can't wait for Panther

:)

Eric a.k.a. TaKeo

Hi TaKeo

I do not see any packets coming back from the server trying to open a data connection to your machine

Code:

Originally posted by TaKeo 

08:26:22.089235 192.168.0.4.52431 > ip240.cactuscom.com.2159: S 3102587044:3102587044(0) win 32768 <mss 1460> (DF)

08:26:34.089631 192.168.0.4.52431 > ip240.cactuscom.com.2159: S 3102587044:3102587044(0) win 32768 <mss 1460> (DF)

08:26:58.090452 192.168.0.4.52431 > ip240.cactuscom.com.2159: S 3102587044:3102587044(0) win 32768 <mss 1460> (DF)

08:27:16.091206 192.168.0.4.52430 > ip240.cactuscom.com.ftp: P 53:79(26) ack 303 win 34080 <nop,nop,timestamp 1834565044 58468700> (DF) [tos 0x10] 

At this point I would expect to see the server try to contact you back on the ftp port and then on a different port.

08:27:17.591019 192.168.0.4.52430 > ip240.cactuscom.com.ftp: P 53:79(26) ack 303 win 34080 <nop,nop,timestamp 1834565046 58468700> (DF) [tos 0x10]

08:27:20.591171 192.168.0.4.52430 > ip240.cactuscom.com.ftp: P 53:79(26) ack 303 win 34080 <nop,nop,timestamp 1834565052 58468700> (DF) [tos 0x10] 

08:27:26.591495 192.168.0.4.52430 > ip240.cactuscom.com.ftp: P 53:79(26) ack 303 win 34080 <nop,nop,timestamp 1834565064 58468700> (DF) [tos 0x10] 

08:27:38.591866 192.168.0.4.52430 > ip240.cactuscom.com.ftp: P 53:79(26) ack 303 win 34080 <nop,nop,timestamp 1834565088 58468700> (DF) [tos 0x10] 

08:28:02.592603 192.168.0.4.52430 > ip240.cactuscom.com.ftp: P 53:79(26) ack 303 win 34080 <nop,nop,timestamp 1834565136 58468700> (DF) [tos 0x10]

In my case

Code:

08:57:26.131393 strider.59223 > ip240.cactuscom.com.1942: S 2102151341:2102151341(0) win 65535 <mss 1452> (DF)

08:57:50.134751 strider.59223 > ip240.cactuscom.com.1942: S 2102151341:2102151341(0) win 65535 <mss 1452> (DF)

08:58:08.137832 strider.59222 > ip240.cactuscom.com.ftp: P 53:79(26) ack 303 win 32940 <nop,nop,timestamp 3623283985 57983245> (DF) [tos 0x10] 

Server talks to me again to go to active on another port..

08:58:08.431090 ip240.cactuscom.com.ftp > strider.59222: P 303:333(30) ack 79 win 64161 <nop,nop,timestamp 57983994 3623283985> (DF)

08:58:08.431258 strider.59222 > ip240.cactuscom.com.ftp: . ack 333 win 32936 <nop,nop,timestamp 3623283985 57983994> (DF) [tos 0x10] 

08:58:08.436584 strider.59222 > ip240.cactuscom.com.ftp: P 79:85(6) ack 333 win 32940 <nop,nop,timestamp 3623283985 57983994> (DF) [tos 0x10] 

After a bit of negotiation on the ftp port the server connects to me on another port..

08:58:08.733331 ip240.cactuscom.com.ftp-data > strider.59227: S 2159696618:2159696618(0) win 64240 <mss 1452,nop,nop,sackOK> (DF)

08:58:08.733564 strider.59227 > ip240.cactuscom.com.ftp-data: S 2792738159:2792738159(0) ack 2159696619 win 65535 <mss 1452> (DF)

It would be interesting to see if the server ever spits anything out again for you as we see nothing from it until exactly a minute after you try to talk to it again.

Quote:

Just a reminder, somebody else from the office can't also connect to our ftp server. No firewall, no router. Straight connection.
...
Eric a.k.a. TaKeo

Well, if you are absolutely positive that there is nothing between your two boxes that could be blocking packets (a switch with vlans defined, router etc), then I would say it must be the server (the OS9 thing does not bother me as it will be using a different TCP stack and possibly could be doing things slightly different (ie using different ports ranges to communicate)). But why does it not work for you locally when it works externally. The only other thing to do would be to dump all the data from packets going back and forth and try to see what your system does that mine does not.