Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a strange problem. netfilter (the module nf_ct_ftp) drops packet from one of my ftp client. But it happens only with this client (91.xxx.xxx.170), all others clients (about 100) are working correctly. Is it maybe a firewall problem on the client side?

Message from syslogd@k002205vsa at Oct 14 10:02:48 ...
 kernel:[1329390.545085] nf_ct_ftp: dropping packetIN= OUT=eth0 SRC=93.xxx.xxx.182 DST=91.xxx.xxx.170 LEN=65 TOS=0x10 PREC=0x00 TTL=64 ID=39044 DF PROTO=TCP SPT=21 DPT=31467 SEQ=2174604744 ACK=404709954 WINDOW=46 RES=0x00 ACK PSH FIN URGP=0 OPT (0101080A13CE13FCF8A12190)

System is Debian with kernel 2.6.32-5 and pure-ftpd as ftp server. Clients are all in passive mode. FTP client is self programmed (not on my own), cause it's running on an STM32 microcontroller. But all other clients are working, so (hopefully) no strange problem with the code. Another problem the server is a managed server, so I don't have access to the iptables rules (sic!). Maybe helpful information of loaded and ftp concerned modules:

└──┤ lsmod | grep ftp
nf_nat_tftp              950  0 
nf_nat_ftp              2015  0 
nf_conntrack_tftp       3321  1 nf_nat_tftp
nf_conntrack_ftp        5521  1 nf_nat_ftp
nf_nat                 13308  12 ipt_REDIRECT,ipt_NETMAP,ipt_MASQUERADE,nf_nat_tftp,nf_nat_sip,nf_nat_pptp,nf_nat_proto_gre,nf_nat_irc,nf_nat_h323,nf_nat_ftp,nf_nat_amanda,iptable_nat
nf_conntrack           46391  31 xt_connlimit,ipt_MASQUERADE,ipt_CLUSTERIP,nf_nat_tftp,nf_nat_snmp_basic,nf_nat_sip,nf_nat_pptp,nf_nat_irc,nf_nat_h323,nf_nat_ftp,nf_nat_amanda,nf_conntrack_amanda,nf_conntrack_sane,nf_conntrack_tftp,nf_conntrack_sip,nf_conntrack_proto_sctp,nf_conntrack_pptp,nf_conntrack_proto_gre,nf_conntrack_netlink,nf_conntrack_netbios_ns,nf_conntrack_irc,nf_conntrack_h323,nf_conntrack_ftp,xt_helper,xt_conntrack,xt_CONNMARK,xt_connmark,xt_state,iptable_nat,nf_nat,nf_conntrack_ipv4
share|improve this question
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.