Intermittant FTP

Gazzmonkey

Hi All,

Have an issue with my FTP server (BPFTP) that I can't figure out, weird thing is.. if I try it several times quickly it sometimes succeeds and I can then browse files on the server.

(000148) 11/17/2015 6:05:41 PM - (not logged in) (178.167.254.155) > connected to IP : 123.12.1.0
(000148) 11/17/2015 6:05:41 PM - (not logged in) (178.167.254.155) > sending welcome message.
(000148) 11/17/2015 6:05:41 PM - (not logged in) (178.167.254.155) > 220 FTP on BPFTP
(000148) 11/17/2015 6:05:41 PM - (not logged in) (178.167.254.155) > USER Gary
(000148) 11/17/2015 6:05:41 PM - (not logged in) (178.167.254.155) > 331 Password required for Gary.
(000148) 11/17/2015 6:05:41 PM - (not logged in) (178.167.254.155) > PASS ********
(000148) 11/17/2015 6:05:41 PM - Gary (178.167.254.155) > logged in.
(000148) 11/17/2015 6:05:41 PM - Gary (178.167.254.155) > 230 User Gary logged in.
(000148) 11/17/2015 6:05:41 PM - Gary (178.167.254.155) > TYPE I
(000148) 11/17/2015 6:05:41 PM - Gary (178.167.254.155) > 200 Type set to I.
(000148) 11/17/2015 6:05:41 PM - Gary (178.167.254.155) > CWD /
(000148) 11/17/2015 6:05:41 PM - Gary (178.167.254.155) > asked to change directory : 'C:\Folder\Gary\ -> C:\Folder\Gary\' --> Access allowed.
(000148) 11/17/2015 6:05:41 PM - Gary (178.167.254.155) > 250 CWD command successful. "/" is current directory.
(000148) 11/17/2015 6:05:41 PM - Gary (178.167.254.155) > SYST
(000148) 11/17/2015 6:05:41 PM - Gary (178.167.254.155) > 215 UNIX Type: L8
(000148) 11/17/2015 6:05:42 PM - Gary (178.167.254.155) > PASV
(000148) 11/17/2015 6:05:42 PM - Gary (178.167.254.155) > 227 Entering Passive Mode (123,12,1,0,192,226)

Not too savvy with networking so apologies if I missed anything obvious.

Regards,
Gary

Nate--IRL--

Sounds like two devices on the LAN with the same Static IP.

Nate

degsie

C:\WINDOWS\system32>ping -t 123.12.1.0

Pinging 123.12.1.0 with 32 bytes of data:
Reply from 123.12.1.0: bytes=32 time=282ms TTL=49
Reply from 123.12.1.0: bytes=32 time=273ms TTL=49
Reply from 123.12.1.0: bytes=32 time=277ms TTL=49
Reply from 123.12.1.0: bytes=32 time=274ms TTL=49
Reply from 123.12.1.0: bytes=32 time=276ms TTL=49
Reply from 123.12.1.0: bytes=32 time=277ms TTL=49
Reply from 123.12.1.0: bytes=32 time=275ms TTL=49
Reply from 123.12.1.0: bytes=32 time=284ms TTL=49
Reply from 123.12.1.0: bytes=32 time=276ms TTL=49
Reply from 123.12.1.0: bytes=32 time=272ms TTL=49
Reply from 123.12.1.0: bytes=32 time=277ms TTL=49
Reply from 123.12.1.0: bytes=32 time=296ms TTL=49
Reply from 123.12.1.0: bytes=32 time=275ms TTL=49
Reply from 123.12.1.0: bytes=32 time=274ms TTL=49
Reply from 123.12.1.0: bytes=32 time=276ms TTL=49
Reply from 123.12.1.0: bytes=32 time=276ms TTL=49

Ping statistics for 123.12.1.0:
    Packets: Sent = 16, Received = 16, Lost = 0 (0% loss)
Approximate round trip times in milli-seconds:
    Minimum = 272ms, Maximum = 296ms, Average = 277ms

Quite long pings to that server, maybe a network problem?

Nate--IRL--

Isn't that just a made up IP? If not .....

inetnum: 123.8.0.0 - 123.15.255.255
netname: UNICOM-HA
descr: China Unicom Henan province network
descr: China Unicom
country: CN
admin-c: CH1302-AP
tech-c: WW444-AP
mnt-by: APNIC-HM
mnt-lower: MAINT-CNCGROUP-HA
mnt-routes: MAINT-CNCGROUP-RR
status: ALLOCATED PORTABLE

Nate

ED E

Once the great firewall of china is involved and you're using an horrendously insecure protocol nothing can be guaranteed.

ItHurtsWhenIP

OP if that 123.x.x.x is your made up internal LAN address, then as pointed out it's going through the planet to get to China.

Change your internal address scheme to anything in the 10.x.x.x. range. You will never have to go through bedrock again. :rolleyes:

Gazzmonkey

Thanks Guys,

For the purpose of this thread I've edited the internal IP of the FTP server from 172.x.x.x to 123.x.x.x as I wasn't sure if it should be shown or not. (maybe I only need to do that for external IP??)

ItHurtsWhenIP

Gazzmonkey wrote: »

Thanks Guys,

For the purpose of this thread I've edited the internal IP of the FTP server from 172.x.x.x to 123.x.x.x as I wasn't sure if it should be shown or not. (maybe I only need to do that for external IP??)

There is a part of 172.x.x.x that is reserved for internal addressing (similar to my suggestion of 10.x.x.x). Here is the list of reserved IP addresses.

You should probably go back to using whatever 172.x.x.x address you were using before.

Gazzmonkey

MMFITWGDV wrote: »

There is a part of 172.x.x.x that is reserved for internal addressing (similar to my suggestion of 10.x.x.x). Here is the list of reserved IP addresses.

You should probably go back to using whatever 172.x.x.x address you were using before.

I am currently using 172.16.0.x on all our client machines and servers.

Except our ISA server, it's on 172.16.1.x

DHCP hands out IPs to clients but I have the servers set to static for what its worth.

Nate--IRL--

I still think something is using the same LAN IP as the FTP server. Change the FTP server IP and then ping the old IP to see if anything else responds.

Nate

brianwalshcork

Gazz,

Are you using ISA to publish the FTP server? Is it ISA 2004/2006 or TMG?

Can you post the ISA logs from your client IP?

Gazzmonkey

@ Nate I'll need to try that later as the server is in production at the moment doing other things like ISS to forward website traffic.

@ BrianWalshCork it's ISA 2004 and yes using it to publish... what do you mean ISA logs from client IP? is that the same as tracert results?

brianwalshcork

Gazzmonkey wrote: »

@ BrianWalshCork it's ISA 2004 and yes using it to publish... what do you mean ISA logs from client IP? is that the same as tracert results?

Under Monitoring - Logging, set up a filter to show all traffic from the IP address of the FTP client (178.167.254.155 in the log in your OP).

Try to connect to the server and check the log for problems. I suspect that you're going to see blocked traffic for the first couple of connection attempts.

You can use the "Copy all results to clipboard" to copy the log, then edit your IPs and paste in here if you want.