Re: Extremely abnormal behaviour: ftp client does show a file list in a folder occasionally

2) for ftp.exe no need exception list, just allow it to go out.

4) did you log 'failed' packets as well?

the log you posted is when the client try to do passive mode.
a) first it talk to ftp port 21.
b) then it uses passive mode to talk to the server port 5004
while source at local is 1805.
c) all port get increment by 1 when more transaction happen.

did you configure passive port range on IIS ?


--
Regards,
Bernard Cheah
http://www.iis.net/
http://www.iis-resources.com/
http://msmvps.com/blogs/bernard/


"kevin" <ocean_chen@xxxxxxxxxxx> wrote in message
news:1173059790.553250.79620@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx



Now back to office after the weekend, I try to open that "tmp1" folder
again in ftp clients, it works even with those suspecious file names
kept within; however, as soon as I change the file name
"Lucy_photo.jpg" and click a refresh button, the ftp client cannot
display the full file list any more. Sigh - it works like a
drunken ...

1) and 2). You are right - we do have IP restrictions and only allow a
limited number of machines for access. I have now added the server IP
on the access list. After adding ftp.exe in the firewall exception
list, and RESTARTING the server, ftp.exe now works on the server
locally and can have access to all folders and display full file lists
- no problem.

3). Inetinfo.exe is now added on the firewall exception list. The same
problem still persists! Even after restarting the server.

4). Enabled the firewall logging and checked each records, it seems
all records display "RECEIVE" except those records related to the
connection between the client machine and the server - a log below

#Version: 1.5
#Software: Microsoft Windows Firewall
#Time Format: Local
#Fields: date time action protocol src-ip dst-ip src-port dst-port
size tcpflags tcpsyn tcpack tcpwin icmptype icmpcode info path

2007-03-05 12:13:28 OPEN-INBOUND TCP yyy.yyy.yy.yy xxx.xxx.xx.xx 1805
21 - - - - - - - - -
2007-03-05 12:13:33 OPEN-INBOUND TCP yyy.yyy.yy.yy xxx.xxx.xx.xx 1806
5004 - - - - - - - - -
2007-03-05 12:13:39 OPEN-INBOUND TCP yyy.yyy.yy.yy xxx.xxx.xx.xx 1813
5005 - - - - - - - - -
2007-03-05 12:13:42 OPEN-INBOUND TCP yyy.yyy.yy.yy xxx.xxx.xx.xx 1814
5006 - - - - - - - - -
2007-03-05 12:14:08 CLOSE TCP yyy.yyy.yy.yy xxx.xxx.xx.xx 1806 5004 -
- - - - - - - -
2007-03-05 12:14:08 CLOSE TCP yyy.yyy.yy.yy xxx.xxx.xx.xx 1813 5005 -
- - - - - - - -

something wrong with src-port and dst-port? Thanks again.



.

Loading