Analyzing FTP problems

File Transfer Protocol (FTP) is a protocol created for transferring files over TCP/IP across a network. FTP is a protocol that runs over TCP ports 20 and 21 for the data and control connections (FTP commands) respectively.

FTP has two modes of operation:

  • Active mode (ACTV): In this mode, the client initiates a control connection to the server, and the server initiates a data connection to the client
  • Passive mode (PASV): In this mode, the client initiates the control and data connections to the server

Both types of connections can be implemented, and they will be explained later in this recipe in the How it works... section.

Getting ready

When working with FTP, if you suspect any connectivity or slow response problems, configure port mirror to one of the following:

  • The FTP server port
  • The client port
  • A link that the traffic crosses

If required, configure a capture or display filter.

How to do it...

To check FTP performance problems, follow these steps:

  1. First, check for any Ethernet, IP, or TCP problems, as described in previous chapters. In many cases, slow responses happen due to networking problems and not necessarily due to application problems.
  2. Check for TCP retransmissions and duplicate ACKs. Check if they are on the entire traffic or only on the FTP connection.

    If you get it on various connections, it is probably due to a slow network that influences the entire traffic.

    If you get it only on FTP connections to the same server or client, it can be due to a slow server or client.

  3. When you are copying a single file in an FTP file transfer, you should get a straight line in the IO graph and a straight gradient in the TCP stream graph (time-sequence).
  4. In the following screenshot, we can see what a bad FTP looks like in the TCP stream graph (time-sequence):
    How to do it...
  5. In the following screenshot, we can see how it looks in the IO graph (configured with filters):
    How to do it...
  6. In the capture file shown in the following screenshot, we can see TCP window problems. These are listed as follows:
    1. The server 15.216.111.13 sends a TCP Window Full message to the client, indicating that the server send window is full (packet 5763).
    2. The client 10.0.0.2 sends a TCP Zero Window message to the server, telling the server to stop sending data (packet 5778).
    3. The server keeps sending TCP Zero Window Probe messages to the client, asking the client if the condition is still zero window (that tells the server not to send any more data). The client answers these messages with TCP Zero Window Probe Ack, indicating that this is still the case (packets 5793 to 5931).
    4. After a while, the client sends the message TCP Window Update to the server, telling it to start increasing the FTP throughput (packet 5939).
    How to do it...
  7. In the preceding case, it was simply a slow client. We solved the problem by working over it and deleting some unnecessary processes.

If you are facing connectivity problems, it can be due to a non-functioning server, firewall that blocks the connection on the way, or software installed on the server or client that blocks it. In this case, go through the following steps:

  1. Was the TCP connection opened properly with the SYN/SYN-ACK/ACK packets? If not, it can be due to:
    • The firewall that blocks communications. Check with the system administrator.
    • The server that is not running. Check this on the server— in the process table, FTP server management, and so on.
    • A software of the server blocks connectivity. It can be an antivirus that has an additional firewall that blocks connections, VPN client, or any other security or protection software.
    • Check the connectivity on the client, too. It can be that it is blocked by a VPN client, a firewall on the client, and so on.
  2. In the active mode, the client opens connection to the server that opens another connection. Make sure that the firewalls on the way support it, or use passive mode.

How it works...

There are two modes of FTP: active and passive. In the active mode, the server opens another connection to the client, while in passive mode, it is the client that opens the second connection to the server. Let's see how it works.

In passive mode, the operations are as shown in the following screenshot:

How it works...
  1. The client opens a control connection from a random port P (1024 in the example) to the server port 21.
  2. The server answers back from port 21 to the client port 1024.
  3. Now, the client opens a data connection from the port P+1 (1025 in the example) to a data port that the server has opened and notified the client about (port 2000 in the example).
  4. The server answers from the data port (2000 in the example) to the client port that initiated the connection, that is, the data port P+1 (1025 in the example).

In the active mode, the operation is slightly different:

  1. The client opens a control connection from a random port P (1024 in the example) to the server port 21.
  2. The server answers from port 21 to the client port 1024.
  3. The server opens the data connection from port 20 to the client port P+1 (1025 in the example).
  4. The client answers from the data port P+1 (1025 in the example) to the server port 20.
    How it works...

There's more...

FTP is a very simple application; and in most cases, FTP problems have very simple solutions. Some examples are as follows:

  • Problem 1: I've monitored an international connection with FTP clients on one side of the network and an FTP server on the other side. The customer complained about slow performance and blamed the international service provider. After checking with the service provider, they said the connection is nearly not loaded (20 percent of a 10 Mbps line), a fact that I confirmed when I checked the line. When I looked at the TCP issues (retransmissions, window problems, and so on), there were none. Just to check, I removed the FTP server and installed another one (there are many free ones), and it started to work. It was a simple problem of an inefficient FTP server.
  • Problem 2: A customer complained that when connecting to an FTP server, the connection was refused after every 5 or 6 trials. When I checked it with Wireshark, I saw that the FTP connection refused messages (and I already knew about this from the customer's complaint), so it looked like a dead end. Just to check, I started to stop the services running on the server, and the problem came out. It was an antivirus software that was interfering with this specific FTP server.

The bottom line is: even with Wireshark (and other software), sometimes common sense will help you more.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
18.119.132.223