[R Briley <rfbrfbrfb61@xxxxxxxxx>]

We have started having problems with a remote system connecting to an ftp server. The client system is Windows 2003. The server is Solaris running ProFTPD.

 

What should I look for to determine what caused the RST. Also, why is it sending out the NBSTAT queries. This system seems to be seeing a large number of checksums, but I'm not sure that this isn't a configuration issue.

 

15           1.930266              server   client     FTP         Response: 230 User ftplslg logged in

16           2.103640              client     server   TCP        1300 > ftp [ACK] Seq=29 Ack=113 Win=65423 [TCP CHECKSUM INCORRECT] Len=0

17           2.928823              client     server   FTP         Request: CWD inbound

18           3.016973              server   client     FTP         Response: 250 CWD command successful

19           3.021788              client     server   FTP         Request: PWD

20           3.114201              server   client     FTP         Response: 257 "/inbound" is the current directory

21           3.410262              client     server   TCP        1300 > ftp [ACK] Seq=47 Ack=182 Win=65354 [TCP CHECKSUM INCORRECT] Len=0

22           3.883197              client     server   FTP         Request: TYPE I

23           4.000257              server   client     FTP         Response: 200 Type set to I

24           4.007553              client     server   FTP         Request: PASV

25           4.095494              server   client     FTP         Response: 227 Entering Passive Mode (192,250,23,244,201,231)

27           4.214908              client     server   TCP        1300 > ftp [ACK] Seq=61 Ack=253 Win=65283 [TCP CHECKSUM INCORRECT] Len=0

44           15.302055            client     server   NBNS    Name query NBSTAT *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>

45           16.801399            client     server   NBNS    Name query NBSTAT *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>

46           18.301354            client     server   NBNS    Name query NBSTAT *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>

47           19.804387            client     server   TCP        1301 > 51687 [SYN] Seq=0 Len=0 MSS=1460

48           19.890076            server   client     TCP        51687 > 1301 [RST, ACK] Seq=0 Ack=1 Win=0 Len=0

53           20.303322            client     server   TCP        1301 > 51687 [SYN] Seq=0 Len=0 MSS=1460

57           26.338282            client     server   TCP        1301 > 51687 [SYN] Seq=0 Len=0 MSS=1460

73           40.535942            client     server   FTP         Request: QUIT

74           40.636636            server   client     FTP         Response: 221 Goodbye.

75           40.637330            server   client     TCP        ftp > 1300 [FIN, ACK] Seq=267 Ack=67 Win=49400 Len=0

76           40.637446            client     server   TCP        1300 > ftp [ACK] Seq=67 Ack=268 Win=65269 [TCP CHECKSUM INCORRECT] Len=0

77           40.639656            client     server   TCP        1300 > ftp [FIN, ACK] Seq=67 Ack=268 Win=65269 [TCP CHECKSUM INCORRECT] Len=0