Unusual IIS/FTP Log entry - Can anyone help? -- iis ftp

Ken Levy
10/27/2004 5:38:40 PM

I was looking through my FTP logs for IIS and came across the following
entry:

User's IP Address 140.137.202.23
Username -
Date 10/2/04
Time 7:45:36
Service / Instance MSFTPSVC4
Computer Name HOST_SERVER
IP Addr of Server 0.0.0.0
Time Taken (ms) 1,546,258,641
Bytes Sent 0
Bytes Received 0
Service Status Code 426
Windows Status Code 10054
Request Type [2251]closed
Target of Operation -

The user IP address is not on our net. The FTP server IS on a public IP
address, though.

1) Can anyone suggest the exact nature of the user activity that is creating
this entry?
2) Any clue as to the LLLLOOONNNGG Time Taken value?
3) What is the number between the braces in the Request Type? Is it the port
of the caller?
4) Can anyone tell me where I can find a list of Windows Status Codes and
Service Status Codes?

Thanks in advance for any assistance. Please post all replies to the
newsgroup.

Ken

Bernard
10/28/2004 1:04:42 PM

1) Not sure, it could be just login and wait..............

2) Have not seen this before. that's few days right ?

3) In W3C extended format [22] PASS is saying this is the 22nd connection
since FTP is running.
you are using IIS log format, if this apply meaning the requested action is
associate with the 2251 connection.

4) For win32 status, you can get it at command prompt
c:\>net helpmsg 10054

IIS Status Code,
http://support.microsoft.com/?id=318380

--
Regards,
Bernard Cheah
http://www.tryiis.com/
http://support.microsoft.com/
http://www.msmvps.com/bernard/

[quoted text, click to view]

iis ftp : Unusual IIS/FTP Log entry - Can anyone help?