Subject: No connection for certain clients with VR17

From: Patrick Feisthammel <[email-masked]>
Date: Wed, 5 May 1999 13:23:50 +0200 (CEST)

Hi!

I have a strange problem. I have VR17 running without problems. But for
certain clients, connects are impossible (they time out befor the Server
sends the '220 FTP Server ready').

The same clients do not have this problem with a very old wu-ftpd
(plain beta 18 I think).

I made tcpdump's of connection negotiation with the old wu-ftpd and with
the VR 17 wu-ftpd. If someone could enlighten me please...

Because of formatting problems in email, I put them on the web:

   http://www.citrin.ch/wuftpd/tcpdump.html

Cheers,
Patrick

---
Citrin, Feisthammel und Partner, 	            Phone: +41 1 994 4038
Winterthurerstr. 43, CH-8610 Uster, Switzerland       Fax: +41 1 994 4036

---

From: Gregory A Lundberg <[email-masked]>
Date: Wed, 5 May 1999 09:35:35 -0400 (EDT)

On Wed, 5 May 1999, Patrick Feisthammel wrote:

> I have a strange problem. I have VR17 running without problems. But
> for certain clients, connects are impossible (they time out befor the
> Server sends the '220 FTP Server ready').
> 
> I made tcpdump's of connection negotiation with the old wu-ftpd and
> with the VR 17 wu-ftpd. If someone could enlighten me please...
> 

Your clients are not responding to RFC 931 AUTH (identd) packets.  The
timeouts are so short on the clients, they're not waiting for the AUTH
timeout to pass.

The correct solution is to have the client respond somehow to the AUTH
packets.  ICMP service not available responses would do fine if the client
cannot or does not want to run identd.

You could recompile the daemon without AUTH by changing the #define
USE_RFC931 to #undef.  Remember, if you do this, your site's security may
be lessened.

-- 

Gregory A Lundberg              Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: Patrick Feisthammel <[email-masked]>
Date: Wed, 5 May 1999 17:35:46 +0200 (CEST)

Hi!

> timeouts are so short on the clients, they're not waiting for the AUTH

Thanks, that was it!

Cheers,
Patrick

---