asked on

Problem with NT4 FTP server

I'm having a problem with an NT4/SP6 system and FTP. Anytime I or another user try to connect to it the following happens:

c:\DOCUME~1\joe\Desktop>ftp {ip_address}
Connected to {ip_address}.
220 nts2 Microsoft FTP Service (Version 4.0).
User ({ip_address}:(none)): {valid_username}
Connection closed by remote host.

c:\DOCUME~1\joe\Desktop>

So all attempts to connect just fail without any password prompt. If I look at the FTP connection list on the server it shows this as being connected. (But obviously it's not.) I have no filters or other security settings in effect (that I know of).

Ideas?

SysExpert

I hope you have already done all the basic stuff.

1) Reboot server

2) Checked all event logs

3) reapply sp6a and any other relevant patches.

4) Check that this is not a virus of some kind.

5) Check the FTP logs, Isn't there an option to provide more debugging info details ?

6) Make sure that all the correct ports are open. Maybe someone has been changing the firewall or similar and blocked the response for FTP ?

I hope this helps !

jhance

ASKER

1) Reboot server

Yes.

2) Checked all event logs

Here is what I get...

In the LOG file:

Y.Y.Y.Y, -, 3/25/02, 10:48:05, MSFTPSVC1, NTS2, 0.0.0.0, 14790427, 0, 0, 426, 10054, [32]closed, -, -,

In the event log:

User {username} at host x.x.x.x has timed-out after 900 seconds of inactivity.

3) reapply sp6a and any other relevant patches.

SP6A re-installed.

4) Check that this is not a virus of some kind.

Norton Anti scan runs clean.

5) Check the FTP logs, Isn't there an option to provide more debugging info details ?

Hmmm, not sure where that is.

6) Make sure that all the correct ports are open. Maybe someone has been changing the firewall or similar
and blocked the response for FTP ?

No firewall involved here and the router is wide open. Another host on the same subnet (Linux) has no trouble with FTP from the same client. So whatever is wrong it's specific to the NT box.

dew_associates

Joe,

Usually when multiple passive connections are made at the same time to a single FTP server it's possible to use up all available system threads for servicing clients. Any additional connection requests will result in the error you note until a client thread is available again. Is there a chance that the server is receiving multiple hits because of the open router, let's say from spammers or maybe cruising hackers?

Den

jhance

ASKER

Dennis,

Thanks for the comment. I don't think that is the issue since there doesn't seem to be any log file evidence of a large number of such hits. Of course there are the usual "noise level" amount of these but nothing out of the ordinary.

I'll try closing the router temporarily, rebooting, and testing from the local subnet just to be sure.

jhance

ASKER

BTW, what is a good way to:

1) Detect that such a thing is going on?
2) Put a stop to it if it is?

This machine needs to be exposed on the internet and is used as a semi-public FTP server.

dew_associates

What are you using to handle FTP, IIS? If yes, which version?

jhance

ASKER

This is NT4/SP6 with IIS4.0.

I tried closing the router, rebooting the system, no change in behavior.

I ran NETSTAT and didn't find any out-of-the-ordinary connections in either type or quantity.

I never have trouble FTPing to the machine from itself.

ASKER CERTIFIED SOLUTION

dew_associates

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

amoisant

try to telnet to the machine on port 21 like so telnet ftp.mycompany.com 21

If you don't get rejected you know the firewall or filters are allowing FTP>

dew_associates

Thanks JH

dew_associates

Joe, sorry for not responding appropriately, is this resolved?

jhance

ASKER

I tried a number of things including your suggestion and somewhere along the way, the problem was resolved. I think your patch had a positive effect.

Thanks.