Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Replies 13 replies
  • Subscribers 0 subscribers
  • Views 4260 views
  • Users 0 members are here
Options
Suggested

[7.480][BUG][ACK] Unable to download file through FTP proxy

Monarch
Hello all,

I cannot download ftp://exftpp.symantec.com/pub/support/products/Backup_Exec_System_Recovery_Server_Edition/304721.pdf by using the FTP proxy (I tried Firefox and Opera, no special FTP client). 

The FTP proxy log shows the following lines per each download attempt: 

2009:09:03-18:34:31 astaro1 frox[22644]: Connect from 192.168.0.14

2009:09:03-18:34:31 astaro1 frox[22644]: ... to 216.10.195.44()

2009:09:03-18:34:41 astaro1 frox[22644]: Server is sending us a badly formed control stream.

2009:09:03-18:34:41 astaro1 frox[22644]: Closing session


As soon as I try to download it directly (proxy disabled) it works.

Regards,
Bastian
Parents Reply Children
  • 0 in reply to Astaro Beta Bot
    same error here also ,pls check log



    ips log:::::


    2009:09:03-22:49:29 ace75 snort[8357]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="alert" reason="(ftp_telnet) FTP response message was too long" group="0" srcip="216.10.195.44" dstip="192.168.1.175" proto="6" srcport="21" dstport="41794" sid="0" class="" priority="3" generator="125" msgid="1"

    2009:09:03-22:50:16 ace75 snort[8357]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="alert" reason="(ftp_telnet) FTP response message was too long" group="0" srcip="216.10.195.44" dstip="192.168.1.175" proto="6" srcport="21" dstport="49430" sid="0" class="" priority="3" generator="125" msgid="1" 

    fw rule log :::::

    22:42:30  Default DROP  TCP 
    10.242.1.2  :  1142
    → 
    216.10.195.44  :  21

    [SYN]  len=48  ttl=127  tos=0x00  srcmac=00:60:08:9b:a5:79  dstmac=00:00:00:00:00:00
    22:42:33  Default DROP  TCP 
    10.242.1.2  :  1142
    → 
    216.10.195.44  :  21

    [SYN]  len=48  ttl=127  tos=0x00  srcmac=00:60:08:9b:a5:79  dstmac=00:00:00:00:00:00

    sid "0" is that ok ?

    Thanks
Unfiltered HTML