Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have a scheduled task that transfers a large file (~130 MB) between two Windows servers using the Windows command-line FTP program. It's painfully slow (taking about 30 minutes) and occasionally terminates before the transfer has completed. The servers are 2003 (sending) and 2008 (receiving).

If I transfer the file manually, using FileZilla's GUI, it runs considerably faster and is done in a couple of minutes. I can't use this approach though, because we want this to run automatically and FileZilla can't be scripted.

I've also noticed, when I disable the Windows 2003 Firewall, command line FTP is suddenly much faster, and reaches the same speed as FileZilla.

So, it seems I have a workaround in disabling/enabling the firewall before and after the transfer. But after Googling extensively, this doesn't seem to be a common problem, and I get the feeling something is configured wrongly somewhere.

Can anyone shed any light on why disabling the firewall improves the speed so dramatically? And why FileZilla is faster than command-line FTP (when the Firewall is enabled)?

share|improve this question
    
Check to see if ICMP is blocked. –  David Schwartz Jan 25 '12 at 2:24
    
Yep, all ICMP requests are blocked. –  Troy Jan 25 '12 at 3:58

3 Answers 3

ICMP is an Internet host requirement. Sometimes admins block all ICMP because they "heard somewhere it was a security risk". But ICMP is not optional and TCP relies on it. (At a minimum, 'fragmentation required' must be permitted.)

share|improve this answer
    
Can you explain the link between ICMP and FTP speed? And why FileZilla is not affected? –  Troy Jan 25 '12 at 4:23
1  
Without ICMP, the FTP packets may get fragmented, which results in greater packet loss and reduced network utilization efficiency. (See my link.) –  David Schwartz Jan 25 '12 at 4:24
    
Tried allowing all ICMP but it didn't change anything. Must be something else. –  Troy Jan 26 '12 at 21:18
    
It's not unusual for more than one thing to be wrong. Trust me, it's much better to fix things before they cause breakage than after. What else is the firewall blocking? –  David Schwartz Jan 26 '12 at 21:28
1  
samsmith, this is a common misconception. Blocking ping is acceptable, but not ICMP as a whole. See Why not block ICMP? –  Chris Kuehl May 20 '12 at 19:54
  1. you need to know what is blocking first. Download Process Monitor from Sysinternals (Microsoft).
  2. In that program, select only "show network activities" (a button on the bar on the upper left)
  3. check the packets and find the FTP ones.

    server1.domain.com:12345 -> server2.domain.com:21

  4. righ click on the name of the process and select include to add the process that is running the ftp.
  5. test the ftp tranfer with the firewall and without it.
  6. compare both data. it should be a port blocked by the firewall. you should open that port between both PCs.
share|improve this answer

The problem is that the command line FTP uses active mode FTP.

Filezilla automatically switches to passive mode ftp, which is much more firewall friendly.

Command line FTP only supports active, so you are stuck there.

Use an alternate utilty for ftp that supports passive mode from a command line (there are cmd line options for filezilla that may meet your needs).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.