Subject: odd logfile entries

From: Andreas Kerber <[email-masked]>
Date: Fri, 26 Feb 1999 17:50:26 +0100

We are using wu-ftp.2.4.2-Beta18-VR14 and I was just grepping
through my logs where I found these entries:

Feb 22 13:38:56 chakotay ftpd[1525]: Accept failed: ???????
Feb 22 13:45:57 chakotay ftpd[1721]: ftp of sungold6.de.ibm.com [195.212.29.70]: data connect from 195.212.29.72 for /pub/windows/win95/misc/SF_Vis_5.exe (961982 bytes)
Feb 23 11:35:02 chakotay ftpd[8499]: ftp of wewak.styria.co.at [194.107.126.109]: data connect from 195.12.208.10 for /pub/windows/win95/misc/sf_98_02.exe (4568806 bytes)

The last two entries concern me bit, can anybody tell me what they mean?

Andreas

---

From: Gregory A Lundberg <[email-masked]>
Date: Fri, 26 Feb 1999 13:47:31 -0500 (EST)

> Feb 22 13:38:56 chakotay ftpd[1525]: Accept failed: ???????

Far end went away; don't worry about it unless it happens a lot.

> Feb 22 13:45:57 chakotay ftpd[1721]: ftp of sungold6.de.ibm.com
> [195.212.29.70]: data connect from 195.212.29.72 for
> /pub/windows/win95/misc/SF_Vis_5.exe (961982 bytes)

> Feb 23 11:35:02 chakotay ftpd[8499]: ftp of wewak.styria.co.at
> [194.107.126.109]: data connect from 195.12.208.10 for
> /pub/windows/win95/misc/sf_98_02.exe (4568806 bytes)

> The last two entries concern me bit, can anybody tell me what they mean?

PASV connections came from a host other than the one which owned the
control connection.

In VR14 the PASV data connection would be refused (disconnected) without
data transfer.  A compile-time option reverts VR14 to the behavior you see
here.

The reasons this is happening are:

 - someone behind a (lame, IMHO) proxy
 - a port scan happened along at just the right instant
 - an attempt to 'steal' the PASV connection

Most likely, it's a proxy issue.

-- 

Gregory A Lundberg              Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: Gregory A Lundberg <[email-masked]>
Date: Fri, 26 Feb 1999 14:03:06 -0500 (EST)

> The reasons this is happening are:
among others,
>  - an attempt to 'steal' the PASV connection

I should also mention that, for those who haven't read it yet, there is
quite a bit more on this subject at:

  ftp://ftp.vr.net/pub/wu-ftpd/ANNOUNCE-VR14

--