false ftp PORT command port

panet · 07-27-2003, 08:08 PM

hi !

I'm trying to connect in port mode from flashfxp to a ftp server, and can't get a dir list, i'm behind a router but i've forwarded a port range and set flashfxp to that same port range, in flashfxp log the PORT command is correct right ip (mine) and port number (within the range i specified), but on the server side the PORT command as the wrong port number (not in my specified port range), i finally did a tcpdump on my router to find out that flashfxp was not using the port in the logs (the right port) but was sending a wrong port to the ftp server.

So we can answer your question more precisely, from now on any question must come the following these info:

* FlashFXP v[2 ].[1 ], build [923 ], [x ]registered, [ ]unregistered, [ ]pirated
* OS [ ] WinXP, [x ] Win2K, [ ] Win98, [ ] WinME, [ ] Other
* Running behind NAT/router [x ] Yes & Model [ipmasq], [ ] No, [ ] Not sure
* Running firewall [x ] Yes, Name [ipchains ], Ver. [ ], or [ ] No
* Running Antivirus [ ] Yes, Name [ ] or [x ] No
* Network [x ] xDSL, [ ] CABLE, [ ] Dail-Up, [ ] Other

additional info if related
* FTP server(s) name [Bulletproof ftp server ], version [2.15 ]
* timestamped, and side prefixed FTP log (please paste)

Original session log from flashfxp side (my side)

Connecting to ServerName
Connected to ServerName-> IP=24.31.210.xxx PORT=21
220 BulletProof FTP Server ready ...
USER panet
331 Password required for panet.
PASS (hidden)
230 User Panet logged in.
SYST
215 UNIX Type: L8
REST 100
350 REST supported. Ready to resume at byte offset 100.
REST 0
350 REST supported. Ready to resume at byte offset 0.
CWD /
250 CWD command successful. "/" is current directory.
PWD
257 "/" is current directory.
TYPE A
200 Type set to A.
PORT 67,68,196,14,5,233
200 Port command successful.
LIST
150 Opening data connection for directory list.
425 Cannot open data connection (10060).
List Error
QUIT
221 Bye bye ...
Logged off: ServerName

-----------------------------------------------------------------------------------
here's a tcpdump of that same session on my linuxbox router,
notice the PORT commands don't match????

220 BulletProof FTP Server ready ...
USER panet
331 Password required for panet.
PASS XXXXXXXXXXX
230 User Panet logged in.
SYST
215 UNIX Type: L8
REST 100
350 REST supported. Ready to resume at byte offset 100.
REST 0
350 REST supported. Ready to resume at byte offset 0.
CWD /
250 CWD command successful. "/" is current directory.
PWD
257 "/" is current directory.
TYPE A
200 Type set to A.
PORT 67,68,196,14,249,70
200 Port command successful.
LIST
150 Opening data connection for directory list.
425 Cannot open data connection (10060).
QUIT
221 Bye bye ...

* any other info
i've set FlashFXP->Options->preferences-> Proxy / Firewall /Indent->Firewall
Limit local port range to 1501-1520
Bind socket to this address to my.dyndns.org (it resolve to my wan ip correctly)

that other ftp server is connected directly to a cable modem (no router)

if you need the complete tcpdump, contact me, i'll sent it to you, without the password

MxxCon · 07-27-2003, 08:51 PM

it appears that your linux router is applying NAPT(network address port translation) on ftp commands.
look into your ipchains config to change/disable this behavior

panet · 07-27-2003, 09:50 PM

i had previously tried to remove the ftp masq module from my ipchains rules, guess needed to reboot, works great now 8)

/sbin/modprobe ip_masq_ftp