Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have just recently got annoyed enough at my own dedicated server's FTP connection delay to go hunting for what causes delay.

"Perpetrator" was IdentLookups configuration option. It defaults to on, thus causing noticeable delay on connection attempt. When switched off, connections are done instantly.

So, my question is: what's intended use of indent lookups? Not just in context of FTP server, but in general? Most firewalls block ident probes, so I don't see the point...

Can somebody enlighten me, please?

share|improve this question
up vote 3 down vote accepted

The ident protocol is used to provide the username related to a TCP connection, mainly when there are many users using a single IP address like shared hosts, etc. It's not very common those days, so for FTP I think it's safe to disable it. IRC still uses it a lot. You can say it's a dying protocol but hey, you never know.

It works querying pairs of tcp ports, like, the ident client asks a port on server:port on client pair to the ident server that answer who is the user responsible for that connection.

Security people don't like this very much, that's why most firewalls block it too, and I tend to agree with them: you can easily enumerate pretty much all users on your servers using it.

RFC 1413 defines a 60-180 second timeout window on the server time, and a minimum wait time of 30 seconds on the client side, that can cause some nasty delays.

share|improve this answer
Thanks. This answer contains info I was looking for. I already knew its intended purpose (to get remote username), but not if it has any (real) value today. – mr.b Sep 12 '10 at 17:57

With IdentLookups on proftpd will attempt to get the username of a new connection using the RFC 1413 ident protocol. The delay will be caused by proftpd waiting for the ident protocol to timeout.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.