iis ftp: Hi,

I have a FTP Server on W2K3 SP1. I'm behind a firewall (Router) and I
was using default port 21. All was fine.

Some times ago, I notice that I was victim of attack. So I decide to
change the port of my FTP Server.

When I change the port for any other port than the default, the client
received the following message:

500 Invalid PORT Command.

The client have this message after the login name and password command
when the dir command is issue.

If the client that connect to me have a router, the error is always
there. If the client don't have a router, it is working fine.

I suspect a NAT problem but I think it's a W2K3 problem also. Do you
have suggestion to correct this and make my connection work again for
client behind a router (which is most of people today) ?

FAQ - and yes - NAT issue

FTP Error: 500 Invalid PORT Command
http://support.microsoft.com/?id=281193

--
Regards,
Bernard Cheah
http://www.iis.net/
http://www.iis-resources.com/
http://msmvps.com/blogs/bernard/


[quoted text, click to view]

Bernard Cheah [MVP] a écrit :
[quoted text, click to view]

This kb article don't give a solution. I already read it but I don't

Bernard Cheah [MVP] a écrit :
[quoted text, click to view]

This kb article don't give a solution. I already read it but I don't

Bernard Cheah [MVP] a écrit :
[quoted text, click to view]

This kb article don't give a solution. I already read it but I don't

Hi,

I am also having a problem with similiar symptons

en we FTP to 164.12.93.146 the Command Port Connection on Port
21 opens fine:


10:19:44.945765 O 0:a0:8e:9f:9a:70 0:0:c:7:ac:0 0800 62:
10.136.211.151.1248 > 164.12.93.146.21: S 1482788929:1482788929(0) win
65535 <mss 1460,nop,nop,sackOK> (DF) (ttl 127, id 45017)
10:19:45.261819 I 0:17:5a:ad:52:4a 0:0:5e:0:1:6f 0800 60:
164.12.93.146.21
[quoted text, click to view]
<mss 1380> (DF) (ttl 58, id 29725)
10:19:45.263198 O 0:a0:8e:9f:9a:70 0:0:c:7:ac:0 0800 54:
10.136.211.151.1248 > 164.12.93.146.21: . ack 3079957754 win 65535 (DF)
(ttl 127, id 45020)
10:19:45.486778 I 0:17:5a:ad:52:4a 0:0:5e:0:1:6f 0800 91:
164.12.93.146.21
[quoted text, click to view]
(DF) (ttl 58, id 29809)
10:19:45.695093 O 0:a0:8e:9f:9a:70 0:0:c:7:ac:0 0800 54:
10.136.211.151.1248 > 164.12.93.146.21: . ack 3079957791 win 65498 (DF)
(ttl 127, id 45023)
10:19:45.952371 I 0:17:5a:ad:52:4a 0:0:5e:0:1:6f 0800 110:
164.12.93.146.21
[quoted text, click to view]
(DF) (ttl 58, id 29912)
10:19:46.101401 O 0:a0:8e:9f:9a:70 0:0:c:7:ac:0 0800 54:
10.136.211.151.1248 > 164.12.93.146.21: . ack 3079957847 win 65442 (DF)
(ttl 127, id 45025)
10:19:56.040887 O 0:a0:8e:9f:9a:70 0:0:c:7:ac:0 0800 70:
10.136.211.151.1248 > 164.12.93.146.21: P 1482788930:1482788946(16) ack
3079957847 win 65442 (DF) (ttl 127, id 45051)
10:19:56.174073 I 0:17:5a:ad:52:4a 0:0:5e:0:1:6f 0800 75:
164.12.93.146.21
[quoted text, click to view]
(DF) (ttl 58, id 33153)
10:19:56.448602 O 0:a0:8e:9f:9a:70 0:0:c:7:ac:0 0800 54:
10.136.211.151.1248 > 164.12.93.146.21: . ack 3079957868 win 65421 (DF)
(ttl 127, id 45054)
10:20:00.150345 O 0:a0:8e:9f:9a:70 0:0:c:7:ac:0 0800 68:
10.136.211.151.1248 > 164.12.93.146.21: P 1482788946:1482788960(14) ack
3079957868 win 65421 (DF) (ttl 127, id 45066)
10:20:00.257271 I 0:17:5a:ad:52:4a 0:0:5e:0:1:6f 0800 80:
164.12.93.146.21
[quoted text, click to view]
(DF) (ttl 58, id 33994)
10:20:00.371373 O 0:a0:8e:9f:9a:70 0:0:c:7:ac:0 0800 54:
10.136.211.151.1248 > 164.12.93.146.21: . ack 3079957894 win 65395 (DF)
(ttl 127, id 45070)

But when the 'dir' command is entered, the client passes (1248 + 2)
back to
the FTP Server for the Data Connection rather than (1248 + 1) & when
the
FTP Server tries to open the Data Connection the client resets it:


10:20:04.334338 O 0:a0:8e:9f:9a:70 0:0:c:7:ac:0 0800 81:
10.136.211.151.1248 > 164.12.93.146.21: P 1482788960:1482788987(27) ack
3079957894 win 65395 (DF) (ttl 127, id 45083)
10:20:04.646064 I 0:17:5a:ad:52:4a 0:0:5e:0:1:6f 0800 95:
164.12.93.146.21
[quoted text, click to view]
(DF) (ttl 58, id 34663)
10:20:04.913172 O 0:a0:8e:9f:9a:70 0:0:c:7:ac:0 0800 54:
10.136.211.151.1248 > 164.12.93.146.21: . ack 3079957935 win 65354 (DF)
(ttl 127, id 45087)
10:20:06.521554 O 0:a0:8e:9f:9a:70 0:0:c:7:ac:0 0800 65:
10.136.211.151.1248 > 164.12.93.146.21: P 1482788982:1482788993(11) ack
3079957935 win 65354 (DF) (ttl 127, id 45091)
10:20:06.602302 I 0:17:5a:ad:52:4a 0:0:5e:0:1:6f 0800 74:
164.12.93.146.20
[quoted text, click to view]
1380,nop,wscale 0,nop,nop,timestamp[|tcp]> (DF) (ttl 58, id 35887)
10:20:06.604266 O 0:a0:8e:9f:9a:70 0:0:c:7:ac:0 0800 74:
10.136.211.151.1250 > 164.12.93.146.20: S 2168842465:2168842465(0) ack
3363574481 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp[|tcp]>
(ttl
127, id 45092)
10:20:06.607198 I 0:17:5a:ad:52:4a 0:0:5e:0:1:6f 0800 85:
164.12.93.146.21
[quoted text, click to view]
(DF) (ttl 58, id 35886)
10:20:06.743409 I 0:17:5a:ad:52:4a 0:0:5e:0:1:6f 0800 66:
164.12.93.146.20
[quoted text, click to view]
820614000 0> (DF) (ttl 58, id 35912)
10:20:06.744512 O 0:a0:8e:9f:9a:70 0:0:c:7:ac:0 0800 54:
10.136.211.151.1250 > 164.12.93.146.20: R 2168842466:2168842466(0) win
0
(ttl 127, id 45094)
10:20:06.765098 I 0:17:5a:ad:52:4a 0:0:5e:0:1:6f 0800 340:
164.12.93.146.20
[quoted text, click to view]
32768 <nop,nop,timestamp 820614000 0> (DF) (ttl 58, id 35913)
10:20:06.766127 O 0:a0:8e:9f:9a:70 0:0:c:7:ac:0 0800 54:
10.136.211.151.1250 > 164.12.93.146.20: R 2168842466:2168842466(0) win
0
(ttl 127, id 45095)
10:20:06.767264 I 0:17:5a:ad:52:4a 0:0:5e:0:1:6f 0800 66:
164.12.93.146.20
[quoted text, click to view]
<nop,nop,timestamp 820614000 0> (DF) (ttl 58, id 35914)
10:20:06.768095 O 0:a0:8e:9f:9a:70 0:0:c:7:ac:0 0800 54:
10.136.211.151.1250 > 164.12.93.146.20: R 2168842466:2168842466(0) win
0
(ttl 127, id 45096)
10:20:06.909208 O 0:a0:8e:9f:9a:70 0:0:c:7:ac:0 0800 54:
10.136.211.151.1248 > 164.12.93.146.21: . ack 3079957966 win 65323 (DF)
(ttl 127, id 45097)
10:20:07.001887 I 0:17:5a:ad:52:4a 0:0:5e:0:1:6f 0800 94:
164.12.93.146.21
[quoted text, click to view]
(DF) (ttl 58, id 36031)
10:20:07.116222 O 0:a0:8e:9f:9a:70 0:0:c:7:ac:0 0800 54:
10.136.211.151.1248 > 164.12.93.146.21: . ack 3079958006 win 65283 (DF)
(ttl 127, id 45099)
10:20:07.217724 I 0:17:5a:ad:52:4a 0:0:5e:0:1:6f 0800 60:
164.12.93.146.21
[quoted text, click to view]


Can anyone explain why the client passes (1248 + 2) back to
the FTP Server for the Data Connection rather than (1248 + 1) & when
the
FTP Server tries to open the Data Connection the client resets it
please?

Thanks

Steve

Nope. some complains that it is IIS issue, while I have seen some managet to
fix it by upgrading the NAT/router firmware.

--
Regards,
Bernard Cheah
http://www.iis.net/
http://www.iis-resources.com/
http://msmvps.com/blogs/bernard/


[quoted text, click to view]

Bernard Cheah [MVP] a écrit :
[quoted text, click to view]

I already upgrade my firmware to last version but with no success. I
have a RV042 Cisco router. And I have the 1.3.7.10 firmware version.

Well, if it works on port21. maybe you can contact cisco and see if they
have a workaround.

--
Regards,
Bernard Cheah
http://www.iis.net/
http://www.iis-resources.com/
http://msmvps.com/blogs/bernard/


[quoted text, click to view]

http://support.microsoft.com/?scid=kb%3Ben-us%3B555022&x=11&y=15