Re: [twsocket] FTP server and passive ports

2008-01-06 Thread Arno Garrels
Arno Garrels wrote:

 Arrgh, after uploading 40.000 files w/o any problem ( all uploads
 used the same listening passive port ) the server rebooted and I now
 need to debug the Minidump it created. Will have a look at that
 file tomorrow :-((

I suspect either the patched tcpip.sys (patch from http://www.xp-AntiSpy.org)
or ProcessExplorer (running at that time). Has anybody seen similiar crashes?

--
Arno Garrels [TeamICS]
http://www.overbyte.be/eng/overbyte/teamics.html
   

***
* *
*Bugcheck Analysis*
* *
***

Use !analyze -v to get detailed debugging information.

BugCheck 10D1, {c, 2, 0, aabf9c02}

Probably caused by : tcpip.sys ( tcpip!ReadNextTCB+d2 )

Followup: MachineOwner
-

1: kd !analyze -v
***
* *
*Bugcheck Analysis*
* *
***

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 000c, memory referenced
Arg2: 0002, IRQL
Arg3: , value 0 = read operation, 1 = write operation
Arg4: aabf9c02, address which referenced memory

Debugging Details:
--


READ_ADDRESS:  000c 

CURRENT_IRQL:  2

FAULTING_IP: 
tcpip!ReadNextTCB+d2
aabf9c02 8b400c   mov eax,[eax+0xc]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0xD1

LAST_CONTROL_TRANSFER:  from aabea6c5 to aabf9c02

STACK_TEXT:  
a9db38f0 aabea6c5 025ac460 a9db3a90 859a5880 tcpip!ReadNextTCB+0xd2
806e5830 05c7fffe fffe0080 0041 0f04eac1 tcpip!TdiQueryInformationEx+0x7e5
WARNING: Frame IP not in any known module. Following frames may be wrong.
a9db3bec aabc703c 859a5880 859a58f0 859a58f0 0x5c7fffe
a9db3c08 aabc6ff4 859a5880 859a58f0 85c88230 
tcpip!TCPDispatchDeviceControl+0x129
a9db3c40 804ef095 861feb98 859a5880 806e5410 tcpip!TCPDispatch+0x127
a9db3c50 8057e70a 859a58f0 85bb5ef8 859a5880 nt!IopfCallDriver+0x31
a9db3c64 8057f56d 861feb98 859a5880 85bb5ef8 nt!IopSynchronousServiceTail+0x60
a9db3d00 805780c2 0038 01d8  nt!IopXxxControlFile+0x5c5
a9db3d34 8054086c 0038 01d8  nt!NtDeviceIoControlFile+0x2a
a9db3d34 7c91eb94 0038 01d8  nt!KiFastCallEntry+0xfc
00aafe20     0x7c91eb94


STACK_COMMAND:  .bugcheck ; kb

FOLLOWUP_IP: 
tcpip!ReadNextTCB+d2
aabf9c02 8b400c   mov eax,[eax+0xc]

FAULTING_SOURCE_CODE:  


SYMBOL_STACK_INDEX:  0

FOLLOWUP_NAME:  MachineOwner

SYMBOL_NAME:  tcpip!ReadNextTCB+d2

MODULE_NAME:  tcpip

IMAGE_NAME:  tcpip.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  444775d3

FAILURE_BUCKET_ID:  0xD1_tcpip!ReadNextTCB+d2

BUCKET_ID:  0xD1_tcpip!ReadNextTCB+d2

Followup: MachineOwner
-
-- 
To unsubscribe or change your settings for TWSocket mailing list
please goto http://lists.elists.org/cgi-bin/mailman/listinfo/twsocket
Visit our website at http://www.overbyte.be


Re: [twsocket] FTP server and passive ports

2008-01-06 Thread Angus Robertson - Magenta Systems Ltd
 So I've made the passive port change in the FTP server, and 
 installed it on the offending server, need to wait for the logs tomorrow to 
 see if the remote clients are happier. 

Using sequential passive ports instead of the same one repeatedly seems
to have fixed my problem.  One client took 30 seconds to upload 15 files
last night, when it was an hour with up 600 failures the previous three
nights.  

There don't seem to have been any FTP failures since I uploaded the FTP
server yesterday afternoon, although most traffic is in the early morning
for the previous day's logs which are zipped and uploaded for import into
SQL, so I won't see today's stuff until tomorrow. 

Angus
-- 
To unsubscribe or change your settings for TWSocket mailing list
please goto http://lists.elists.org/cgi-bin/mailman/listinfo/twsocket
Visit our website at http://www.overbyte.be


Re: [twsocket] FTP server and passive ports

2008-01-05 Thread Angus Robertson - Magenta Systems Ltd
 Is this the original ICS FTP server component with your latest
 changes? 

Yes, not the socket server versions, and I'm not made any changes to
passive mode, ports or data connections, except the data source. 

Angus

-- 
To unsubscribe or change your settings for TWSocket mailing list
please goto http://lists.elists.org/cgi-bin/mailman/listinfo/twsocket
Visit our website at http://www.overbyte.be


Re: [twsocket] FTP server and passive ports

2008-01-05 Thread Angus Robertson - Magenta Systems Ltd
 For some reason, the passive port pool does not allocate
 sequential port numbers, but continually re-allocates the same 
 numbers

My client application swaps between two FTP servers when errors occur.
The second server is still IIS/5 and the logs show that passive ports are
always incrementing, not being immediately re-used, and the ICS FTP
client software works fine.  

The passive port pool seems to have been added by 'NGB' but I don't know
who that is, or why he decided to re-use ports, there are no relevant
comments.  Is there any reason why I should not change it to use
incrementing ports within the passive pool range? 

BTW, the port issue effects consecutive downloads as well as uploads. 


Angus

-- 
To unsubscribe or change your settings for TWSocket mailing list
please goto http://lists.elists.org/cgi-bin/mailman/listinfo/twsocket
Visit our website at http://www.overbyte.be


Re: [twsocket] FTP server and passive ports

2008-01-05 Thread Arno Garrels
Angus Robertson - Magenta Systems Ltd wrote:
 Is there any reason why I should not change it to
 use incrementing ports within the passive pool range?

I guess that won't make a difference, since if a port were
still in use an exception in Listen/Bind should be raised
and CommandPASV() should return the error. Isn't it possible
that winsock refuses the connection attempt due to a full 
ListenBacklogQueue, if that's a global recource?
Is the server very busy at that moment? Anyway it must not
get out of sequence, I wonder why.

Arno  
-- 
To unsubscribe or change your settings for TWSocket mailing list
please goto http://lists.elists.org/cgi-bin/mailman/listinfo/twsocket
Visit our website at http://www.overbyte.be


Re: [twsocket] FTP server and passive ports

2008-01-05 Thread Angus Robertson - Magenta Systems Ltd
 I guess that won't make a difference, since if a port were
 still in use an exception in Listen/Bind should be raised
 and CommandPASV() should return the error. 

There is a table in the server which keeps track of which passive ports
are in use, although it won't help if another application is using the
port. 

 Isn't it possible that winsock refuses the connection attempt due 
 to a full ListenBacklogQueue

Unlikely, these are Windows 2000 servers running IIS/5 FTP for five years
or so (and FileZilla) without any problems, I've only just changed one to
use ICS FTP server now it has mode z.   

Looking at more logs, I see: 

'501 Cannot RETR. Error - Connection reset by peer (#10054)' and 
'501 Cannot RETR. Error - Connection aborted (#10053)' errors 

are coming back as well for passive downloads.  But they usually work on
the next attempt. 

Angus

-- 
To unsubscribe or change your settings for TWSocket mailing list
please goto http://lists.elists.org/cgi-bin/mailman/listinfo/twsocket
Visit our website at http://www.overbyte.be


Re: [twsocket] FTP server and passive ports

2008-01-05 Thread Arno Garrels
Angus Robertson - Magenta Systems Ltd wrote:
 I guess that won't make a difference, since if a port were
 still in use an exception in Listen/Bind should be raised
 and CommandPASV() should return the error.
 
 There is a table in the server which keeps track of which passive
 ports are in use, although it won't help if another application is
 using the port.

This concept and the fact that passive listening sockets are
created dynamically when a range is used may be a weak point,
though that must not be the problem here. 

Btw: Serv-U opens one persistent listening socket per port in the
range on startup, thus once they are listening no subsequent
probs. with ports in use can happen. 

 
 Isn't it possible that winsock refuses the connection attempt due
 to a full ListenBacklogQueue
 
 Unlikely, these are Windows 2000 servers running IIS/5 FTP for five
 years or so (and FileZilla) without any problems, I've only just
 changed one to use ICS FTP server now it has mode z.
 
 Looking at more logs, I see:
 
 '501 Cannot RETR. Error - Connection reset by peer (#10054)' and
 '501 Cannot RETR. Error - Connection aborted (#10053)' errors
 are coming back as well for passive downloads.  But they usually work
 on the next attempt.

Can you reproduce those errors in a simple environment that uses 
plain TCP/IP connections? Later today I will try as well.

Arno 
-- 
To unsubscribe or change your settings for TWSocket mailing list
please goto http://lists.elists.org/cgi-bin/mailman/listinfo/twsocket
Visit our website at http://www.overbyte.be


Re: [twsocket] FTP server and passive ports

2008-01-05 Thread Angus Robertson - Magenta Systems Ltd
 Can you reproduce those errors in a simple environment that uses 
 plain TCP/IP connections? Later today I will try as well.

No, I can not reproduce any passive problems locally with a server on my
development PC, or my local Windows 2000 server, or by accessing the
offending FTP server over the VPN, 100 files uploaded without error. 

So I've made the passive port change in the FTP server, and installed it
on the offending server, need to wait for the logs tomorrow to see if the
remote clients are happier. 

I suspect the real cause of the problem is one of the Sonicwalls, FTP is
always trouble with firewalls (even without NAT issues), yet these
passive errors occur much less frequently with IIS/5 than with ICS, I saw
two FTP errors with IIS/5 yesterday, and maybe 2,000 with ICS (many of
those were the consequence of the FTP responses getting out of step). 

Angus
-- 
To unsubscribe or change your settings for TWSocket mailing list
please goto http://lists.elists.org/cgi-bin/mailman/listinfo/twsocket
Visit our website at http://www.overbyte.be


Re: [twsocket] FTP server and passive ports

2008-01-05 Thread Arno Garrels
Angus Robertson - Magenta Systems Ltd wrote:
 Can you reproduce those errors in a simple environment that uses
 plain TCP/IP connections? Later today I will try as well.
 
 No, I can not reproduce any passive problems locally with a server on
 my development PC, or my local Windows 2000 server, or by accessing
 the offending FTP server over the VPN, 100 files uploaded without
 error. 

Arrgh, after uploading 40.000 files w/o any problem ( all uploads
used the same listening passive port ) the server rebooted and I now
need to debug the Minidump it created. Will have a look at that
file tomorrow :-((

Arno




-- 
To unsubscribe or change your settings for TWSocket mailing list
please goto http://lists.elists.org/cgi-bin/mailman/listinfo/twsocket
Visit our website at http://www.overbyte.be