Subject: PORT connection refusal during web ftp conection

From: Brian Leighfield <[email-masked]>
Date: Mon, 13 Jul 1998 08:52:17

On sporadic occasions when someone coming in via a web ftp read, when a 
'hot-spot' is selected using the mouse ( presumably pointing to a second 
document to read ) a 'port connection refused' occurrs.
The message file gives :-
Jul  9 14:26:55 ftp ftpd[14955]: refused PORT 128.0.0.37,64697 from
172.16.0.252 
If the user persists they may get a connection.

We are SunOS ftp 5.5.1  running on a Sparcstation 5.
It seems we are running in 'passive' mode. I know nothing about the ins and
outs
of 'active' and 'passive' mode but would like to find out more. For The
moment I
would like to ask if anyone knows the correc remedial action for the
current problem.

What I fail to understand is the simmple issus of weither my machine is
refusing, or is being refused a port. If it is my machine could there be
some limitation on the number of PORTS, or could it be a time-out problem
etc ?

Any help gratefully received :-)
Brian Leighfield

---

From: Gregory A Lundberg <[email-masked]>
Date: Mon, 13 Jul 1998 09:53:18 -0400 (EDT)

> document to read ) a 'port connection refused' occurrs.

I'm not sure what you mean here, but assume you mean someone's using a web
client to browse an ftp site and has clicked on one of the files in the
directory listing.

> The message file gives:
> Jul 9 14:26:55 ftp ftpd[14955]: refused PORT 128.0.0.37,64697 from 172.16.0.252

This message, 'refused PORT' comes from ftpcmd.y upon receipt of a PORT
command from the client.  It is written to the system log and '500 Illegal
PORT command' is returned to the client when the client attempts to
specify a passive-mode port for a data-transfer connection, and the client
has not yet logged into the ftp site or has specified an IP number
different than the one from which the control connection originates.

> We are SunOS ftp 5.5.1 running on a Sparcstation 5.  It seems we are
> running in 'passive' mode. I know nothing about the ins and outs of
> 'active' and 'passive' mode but would like to find out more. For The
> moment I would like to ask if anyone knows the correc remedial action
> for the current problem. 

> some limitation on the number of PORTS, or could it be a time-out
> problem etc ? 

Your machine is refusing to honor the PORT.  The stock beta-18 daemon does
not limit the PORT port number, but does limit the IP address for the
PORT.  While this could be a time-out issue, I'd look at other possible
causes first; for instance, are the users having problems all coming in
from the local machine?  or from a firewall or proxy?  If the IP numbers
are changing the daemon will refuse the PORT.  Yes, it could also be a
time-out issue if the user is waiting 10 minutes or so (or whatever you've
set as the time-out) before clicking the filename, thet will have been
forced out but the web client may not recognize the fact.

One final thought:  If everything else seems OK, check the return type for
the ntohs() function on your machine.  The port number in your log message
above could be interpreted as a negative number if ntohs() returned an int
instead of an unsigned int.  The compiler would generate a signed >
compare, which the port number given above would fail.  The code (in
ftpcmd.y) is:

              if (cliaddr.s_addr == his_addr.sin_addr.s_addr
              && ntohs(cliport) > 1023) {

----

Gregory A Lundberg		Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195