Ticket #5437: analyze.log

File analyze.log, 4.3 KB (added by Constant, 9 years ago)

My analyze of capture tpcdump

3File concern:winscp418setup.exe
6* step 1: paquets 1-28, creation of SOCKET1
7* step 2: paquet 29, client send "PASV" command
8* step 3: paquet 30, server response with ip address and port (here:
9* step 4: paquet 31, client send "LIST" command
10* step 5: paquet 32, client create a new socket, SOCKET2 with information of step3:Client(1176)-Server(27909)
11* step 6: paquets 34 and 35, end of creation of socket
12* step 7: paquet 36, on SOCKET2, server send a result of command "LIST" send in SOCKET1
13* step 8: paquet 38, immediately, server close SOCKET2
14* step 9: paquets 39/40 and 44, end of SOCKET2
15* step 10: paquets 41-43,45-47, on SOCKET1, many FTP command are sent
16* step 11: paquet 48,FileZilla create a new socket on port 21, SOCKET3 (1177)-Server(21).
17Socket is create because i drag'n'drop file "winscp418setup.exe" from local workstation to server.
19On this step, we have 2 SOCKETS for CONNEXION DATA.
20SOCKET1 Client(1175)-Server(21)
21SOCKET3 Client(1177)-Server(21)
22* step 12: paquets 49-57, on SOCKET3, authentification with the same credentials use for SOCKET1
23* step 13: paquets 58-66, on SOCKET3, many commands are use
24* step 14: paquet 67, client send PASV command
25* step 15: paquet 68, server response with ip address and port (here:
26* step 16: paquet 69, client send "STOR" command with name of file
27* step 17: immediately, client create a new socket, SOCKET4 Client(1179)-Server(41339)
28* step 18: paquets 71 and 72, end of creation of SOCKET4
29On this step, we have 3 SOCKETS: 2 for CONNEXION DATA and 1 for command
30SOCKET1 Client(1175)-Server(21)
31SOCKET3 Client(1177)-Server(21)
32SOCKET4 Client(1179)-Server(41339)
33* step 19: paquets 73-74,77-3319, on SOCKET4, upload of file "winscp418setup.exe"
35KEEP alive
36* step 20: paquet 3057, during transfert on "step 19", client send "anti-deconnexion COMMAND"
37on SOCKET1
38* step 21: paquet 3064 concern by "keep alive" of SOCKET1, it's confirmation of paquet 3057
40* step 22: paquet 3320, client send a last segment of file with TCP Flag "FIN" termine upload of file "winscp418setup.exe"
41* step 23: paquets 3321-3336, server acq a last segment
42* step 24: paquets 3337, server acq close SOCKET4, it's response of paquet 3320 on step 20
43* step 25: paquet 3338, client close definitively SOCKET4
44* step 26: paquet 3339, Server, on SOCKET3, send a command to indicate that "transfert complete"
45* step 27: paquet 3340, client send "PASV" command
46* step 28: paquet 3341-3342, server response with ip address and port (here:
48* step 29: paquet 3343, client send "LIST" command on SOCKET3
49* step 30: paquet 3344, client create a new socket, SOCKET5 with information of step28:Client(1180)-Server(18393)
50* step 31: paquets 3345 and 3346, end of creation of socket
51* step 32: paquet 3348, on SOCKET5, server send a result of command "LIST" send in SOCKET3
52* step 33: paquet 3349, immediately, server close SOCKET4
53* step 34: paquet 3350, server send a command on SOCKET3
54* step 35: paquet 3365, correspond when i click on "disconnect". client send a FIN of SOCKET3
58Actions to realize:
59- start FileZilla Client configure with keepAlive
60- connect to FTP server (Passive mode)
61- upload a file on server
62- close file
64For realize that, FileZilla will create:
65-2 sockets COMMAND (port 21). With KeepAlive option, FileZilla will on send "KeepAlive" command
66on one socket
67-a lot of sockets DATA, in my case, 3.
70When i transfert a long file (transfert during 20 minutes for exemple),
71With Firewall (who manage a timeout in one connexion who is 15mn) between client and Server FTP,
72one socket in 20 minutes will be kill by the Firewall because no command KEEP-ALIVE is present
73on this session.
75The impact
76FileZilla Client, when receive a RST packet from Firewall for a session who is timeout, he stop
77ftp transfert and try again. This process slows the copy
80Firt solution
81Use only 2 sockets:
82- one socket only for command
83- another socket only for data
84Second solution
85- before create a new session of command, close all last sessions command to have just only one
86session of command
88I send:
89- capture realise on my computer
91I try the others Client FTP and they use
92will be kill by the firewall
93FileZilla, to transfert a simple file, use a lot of socket (DATA and