Linksys → FTP 3 minute disconnection.

Okay I am all out of luck and my friends on the "outside" are starting to not help.

Let me put fourth all the facts and see if anyone has anything they can put fourth as being the issue.

I am on Roadrunner cable and I have 3 computer connected to the cablemodem via a Linksys BEFSR41 with a firmware version of 1.40.2.

Linksys is set to NON DHCP and all machines are set with static IP settings starting at 101 as the final number in the IP.

X.X.X.101 is a file server, X.X.X.102 is a non internet gaming computer and X.X.X.103 just goes on IRC and web browsing (its the wifeys computer).

Now here is the problem I have the following ports forwarded to the file server/ftp server. Port 21 and port 8888-8900 (to allow for pasv). The FTP server application G6ftp has default port of 21 and pasv ports setup of 8899-8900 and has the WAN IP put in place.

Now here is the interesting part. People can connect to my FPT server and do surfing of the directories but here is when I get the issue. As soon as someone tries to transfer (either uploading or downloading) the who router seems to be "reset". On IRC we get the error "Software has caused a connection abort" upon trying to ping an outside address we get nothing. I have tried checking the MTU speed on the router and changing some of the settings but that does not seem to help it. I have also tried using non standard ports on the FTP (making 8888 be the port).

Is the logging feature is enabled on the router? If so try to disable it and see if it fix yout problem.

Dump the firmware and upgrade to the latest. I think this will resolve your issue.

Matt

Here's my findings that sounds similar:
INFO: How I hang my BEFSR41

I've always theorized some kind of dynamic routing table overflow/corruption or failure-to-clear is involved (note some run time is needed). I cannot go much further from the outside of the box.

Some get this, some don't. A user named Dee had horrific problems just like you describe on an FTP server but mine was never that bad. It happened, just not nearly as often. I tried like heck to cause it repeatably from a major RESET but never succeeded - lots of run time is needed. This indicates to me there's a bit more to that equation.

Oh yeah... a "Dummy DMZ" seems to make it worse. I think this just makes the routing table fill faster(?).

In the year 2001 I did a lot of running on f/w 1.30 (Jun 2000). It's old and lacks many features and has no forwarded port *ranges* (10 ports, period, is the limit). You're not using PPPoE so maybe it'll work for you. I've never seen 1.30 "break". I'm curious if you see the same.

EDIT: I'm also curious if current 1.42.6 does you any good. Lots of rewrite in this guy and some other old bugs seem to be fixed. However, it didn't take long for me to hang it with a scan but I'm not using the LinkSys much these days. There is also some very strange behavior in scan replies for a few minutes after changing settings.

[text was edited by author 2002-04-12 21:50:56]

1) Logging has been ran enabled and disabled with the same results.
2) DMZ has not resolved this issue in the least. (Interesting thing is I was able to play EQ which needs tons of ports through the DMZ with no problems disconnecting though FTP I can make hang on me all the time).
3) I am now about to try the latest firmware though I have tried now 3 firmware updates with the same issue (In fact I had used the v 1.30 then upgraded to another firmware and then tried a 3rd, the current, firmware).

I'll post back if I can "break" 1.42.6 in this same manner. I am sure I can recreate this problem for the 100th time.

Ahhhh got some more interesting info....

Here is the logs from 1 the server and 2 the one trying to get the file.

First the server.
(000023) 4/11/2002 10:34:46 PM - (not logged in) (24.161.240.66) > USER XXXXX
(000023) 4/11/2002 10:34:46 PM - (not logged in) (24.161.240.66) > 331 Password required for XXXXXX.
(000023) 4/11/2002 10:34:47 PM - (not logged in) (24.161.240.66) > PASS XXXXXXX
(000023) 4/11/2002 10:34:47 PM - XXXXX (24.161.240.66) > logged in.
(000023) 4/11/2002 10:34:47 PM - XXXXX (24.161.240.66) > 230 User XXXXX logged in.
(000023) 4/11/2002 10:35:00 PM - XXXXX (24.161.240.66) > TYPE I
(000023) 4/11/2002 10:35:00 PM - XXXXX (24.161.240.66) > 200 Type set to I.
(000023) 4/11/2002 10:35:00 PM - XXXXX (24.161.240.66) > PASV
(000023) 4/11/2002 10:35:00 PM - XXXXX (24.161.240.66) > 227 Entering Passive Mode (65,33,82,165,34,189).
(000023) 4/11/2002 10:35:00 PM - XXXXX (24.161.240.66) >
(000023) 4/11/2002 10:35:00 PM - XXXXX (24.161.240.66) > RETR Filename1
(000023) 4/11/2002 10:35:00 PM - XXXXX (24.161.240.66) > asked to download 'Filename1' --> Access allowed.
(000023) 4/11/2002 10:35:00 PM - XXXXX (24.161.240.66) > 150 Data connection accepted from 24.161.240.66:1343; transfer starting for Filename1 (15000000 bytes).
(000023) 4/11/2002 10:35:00 PM - XXXXXX (24.161.240.66) > started downloading 'Filename1'.
(000023) 4/11/2002 10:38:33 PM - XXXXXX (24.161.240.66) > aborted downloading

The outside FTP client -
TYPE I
200 Type set to I.
PASV
227 Entering Passive Mode (65,33,82,165,34,191).
Connecting to XXXXX port 8895
Data Connection opened.
RETR Filename1
150 Data connection accepted from 24.161.240.66:1337; transfer starting for Filename1 (15000000 bytes).
Connection timed out.
Data Connection closed
852,928 bytes transferred in 00:03:33, 4,004 bytes/sec
Reconnecting...

One thing I noticed the 2 small files that succeeded in transfering were Type A transfers.... Whats the difference between a Type A transfer and a Type I?

said by Out of luck:

---

One thing I noticed the 2 small files that succeeded in transfering were Type A transfers.... Whats the difference between a Type A transfer and a Type I?

---

A-ASCII text vs. I-BINARY. ASCII is used for directory listings. Wrong mode can corrupt data but shouldn't hang anything.

I note from that log it's a normal PASV mode data transfer. The port your end used (from 34,189) is 8893. Yep... looks like connection starts then poops out.

Another "maybe"... did you try: INFO: The Looooong Reset?
[text was edited by author 2002-04-12 23:33:17]

Here's another "maybe". Since he's on cable, this probably isn't the issue but worth investigating. Since small files are making it and large ones aren't, could this be an MTU issue?

Ahhh okay that nips that theory in the bud... the only thing is the 2 items being downloaded prior were text files and not data files (hence why they were smaller).

Hrmmm as for the long reset I guess I have failed to mention I have tried this with 2, yes count them 2, Linksys routers. I picked up a second one just the other day in thoughts I might have had a bad router. I returned it the second it gave me the same problem as the original one did. Yes on both I reset the router with no success either.

The things about this issue I find baffeling are as follows.

1) They can connect to the FTP but then data transfer just stops.
2) Not only does it stop but it tosses everything behind the router off the network (internet).
3) Within 1 minute the router is able to "recover" itself and everything can reconnect until the next FTP download.
4) I can recreate this problem every single time.

Just for kicks, download DRTCP and manually set the MTU for the NIC on the G6 computer to 1500. Reboot and see what happens.

As for MTU's I have tried 1500 to 900 in different increments. I am assuming the lower I dropped it the least likely it would "drop off" the way it is. Question is anyone familiar with bandwidth restriction on an FTP? Could it be that the FTP is taking too much of my bandwidth and is just dropping us off? I noticed the setting within g6ftp but I did not fiddle with it because no site told me that was needed.

Not a bad thought. OOL's end shouldn't have an issue but the clients might. OOL, if MTU is getting it about 1400 bytes and below should always work.

More here: MTU, PPPoE, Servers and LinkSys Routers

Are you talking about the MTU setting in the Linksys or in the computer running G6? I seriously doubt the bandwidth being used by your G6 server is the culprit. You would want G6 to use every last drop it could.

said by Out of luck:

---

Question is anyone familiar with bandwidth restriction on an FTP? Could it be that the FTP is taking too much of my bandwidth and is just dropping us off? I noticed the setting within g6ftp but I did not fiddle with it because no site told me that was needed.

---

Data may flow slower but timeouts tend to be a minute of NO data.

OOL, when it "hangs", can you ping the router LAN address? Can you access the router setup page? If not, I have to believe f/w is lost.

Just thought of something....there have been reports of people using PPPoE having the router barf on heavy upload streams. It's unclear whether it's being caused by the router or the ISPs upload channel doing something strange, but it will cause PPPoE session loss and router resets/freezes. We had one in Ameritech who finally ditched the Linksys and bought a Netgear because of this problem.

Anyway, you may be able to see what is going on if you enable SNMP Trap logging (other than the standard IN/OUT stuff). See »Linksys FAQ »How do I turn on SNMP traps for logging? [Wired Routers] for details. The Linksys may be telling you what's going on but you aren't there to hear it.

Well I am headed to bed. Last update of the night.

1) I am able to ping the router through an entire disconnect. Including checking the setup of the router.

2) When they are connected my data transfer rate is all over the scale (I mean it fluxuates from 15 to 60k)

3) This is after setting the FTP server PC to MTU of 1500

To be honest I do not know how to read any of these logs and to decyper most of them to see whats going on.I have routed linksys to default the logs to my pc and setup Link logger but ???all it is showing me is that the people are connecting to me via ports I already knew I had opened and set up???

Anyhow if anyone thinks of anything over the night feel free to drop me a line I don't give up easy on tough situations so I am sure I'll be bugging you guys more.

First time posting in this forum and funny enough i find this thread that talks about the same problem that i am having with my Linksys BEFW11S4 running firmware 1.39.2. I have 2 computer (1 desktop and 1 laptop connected through the wireless connection) connected to the router for basic internet sharing.
The behavior that you describes occurs to me while downloading from Mirc. The router appears to 'reset' itself and stop functioning. Both computer lose the ability to connect to the internet and my wireless connection to the laptop goes down as well.
To fix the problem i have to press the 'reset' button in the back of the router in order to get things working again. This is very inconvenient as all the setting for the router are lost.
I have DHCP disabled, no ports are being forwarded.

A second scenario which also produces the router to stop responding is when I change a setting in the router's configuration page. Sometimes, not all the time, the router will stop functioning. When I try to log into the configuration page it does not accept my password or the default password 'admin' and get a red page with and 'Unauthorized' statement.

This is just to let you know that your not the only one experiencing the same issue here.

Okay RadioDoc I went in and adjusted the settings for the router to log everything under the sun (well almost).Then I went and downloaded a second client (I have Link logger and now Log Viewer.)I know when I was looking at the in out of link logger it was only showing people connecting to my computer on the forwarded ports. So what exactly am I looking for with all this new information? I won't have anyone connecting to my site for a bit I just am wanting to know what I am looking for when I see it.

Okay with this new application I am seeing something very disturbing..... Can anyone tell me "why" this would be occuring?

As soon as I started up the logging I have gotten this the interesting thing is its hitting my WAN IP and is not directed "into" my network. It also occuring when I turn of any one of my computers with the other 2 up and running. I would hazard a guess as it is cycling up ports I am eventually hitting port collisions with the ones I have opened up for FTP? could this be a big possibilty?

4/13/2002 17:48:24:621 Inbound TCP WAN IP 2825 65.89.43.128 (freeonlinestockquote.com) 1239 Block
4/13/2002 17:49:29:814 Inbound TCP WAN IP 2826 65.89.43.128 (freeonlinestockquote.com) 1239 Block
4/13/2002 17:50:35:018 Inbound TCP WAN IP 2827 65.89.43.128 (freeonlinestockquote.com) 1239 Block
4/13/2002 17:51:40:252 Inbound TCP WAN IP 2828 65.89.43.128 (freeonlinestockquote.com) 1239 Block
4/13/2002 17:52:45:806 Inbound TCP WAN IP 2829 65.89.43.128 (freeonlinestockquote.com) 1239 Block

It is now up to port 3128

Let me know 1) what to think (if this is really a problem?)and 2) how in the heck I can get an IP to not randomly count up my ports trying to connect to my WAN IP?

Very interesting... this address seems to be running a port scan on you. Not a very stealthy one - sequential ports yet! I suppose it *could* create the conditions that kills the LinkSys.

That address is interesting, too. It has rDNS but no forward DNS at all. For that reason it sounds like an attempt to look docile (? - shrug) and/or is locally spoofed because it's a selected screwed up address. It's registered to:

Broadwing Communications, Inc. (NETBLK-BROADWING-2BLK) BROADWING-2BLK
65.88.0.0 - 65.91.255.255

And probably leased to...
Pulse Web Ventures (NETBLK-BRW-4202-PULSEWEB2) BRW-4202-PULSEWEB2
65.89.42.0 - 65.89.43.255

Looks like it's 1-per-second. It shouldn't be causing NAT entries. Even when it hits forwarded addresses ports (when NAT table entries get formed) it's not fast enough to be much harm IMHO.

I'm just reporting facts. Maybe someone will get a spark of insight from speculation.

EDITED for brain f*rt.
[text was edited by author 2002-04-13 18:44:28]

All the new 1.4X firmwares are very buggy, the Linksys has a tendancy to crash a lot for various reasons.

Roll back to a 1.3X firmware and your problems will go away.

The same thing was occuring on those as well if you read my second post. If there is a specific previous version you think I should try please include it in your post.

Okay here are my findings -
firmware 1.37 (hangs)
firmware 1.39 (hangs)
firmware 1.30 (hangs and has very little functionality )
firmware 1.40.2 (hangs)

All seem to do the same thing.
Hang up on the internet connection and lose all WAN information in the router then 3 minutes later boom the WAN info is back and its running again until someone connects via FTP then about 3-5 minutes after they connect via FTP I am knocked offline again.

I have tried ports 20-21 and pasv ports 8888-8900 open (on all firmwares cept for the 1.30 I had to limit down the pasv port range) after each firmware I held down the reset button at least 2 minutes and power cycled the router. Argh I am going crazy over here.

said by Out of luck:

---

...and lose all WAN information in the router... then 3 minutes later boom the WAN info is back...

---

Whoa... define exactly what that means? Status page WAN info? Setup page WAN info?

All the WAN information on the setup page on the linksys router. The page that states nothing is configureable. It shows all 0's on it and like it is losing the connection to the ISP. however I know it is not ISP related due to the fact that my computer connected alone ot the ISP works just fine.

Okay heres the last thing I am noticing and I really can't post anything more that would be of help.

It is something between the FTP server program and the router.

When I get "disconnected" in the status screen under WAN IP that IP drops to 0.0.0.0 all other fields are still filled in. All items on the LAN work fine.

The second I disconnect the G6 ftp server the router "gets back" the IP.

As I have posted both router logs and server logs I don't see anything out of the ordinary. If anyone can recommend anything (other than trying a new FTP server program because I just tried serv-u with no success).

Argh can't believe a stupid machines problem is gonna beat me.

Well... it sure sounds like the LinkSys is being directly affected. You said when you "disconnect the G6 ftp server" it instantly comes back... meaning you're closing G6? Taking it offline?

The LAN boxes are static... How's the WAN set? DHCP? Can you set it static just to see if that changes anything? (don't release a DHCP lease and just set it static should work).

I cannot imagine a packet the G6 server box could possibly emit that could cause this. When it's "locked up" what does commandline: netstat -an show? ("locked up" = LinkSys at 0.0.0.0, G6 still running). This is a key condition to examine things. Is there constant activity shown anywhere?

This one's a REAL CHALLENGE!

EDIT: Capturing the packets on the G6 box at/during the hang would be my next logical step. Ever work with a packet sniffer? Here's a real simple one: »www.nextgenss.com/produc ··· iff.html

[text was edited by author 2002-04-16 21:34:25]

Just curious, what version of G6 are you using? G6 has long become BPFTP Server.

said by Out of luck:

---

If anyone can recommend anything (other than trying a new FTP server program because I just tried serv-u with no success).

---

Exact same silly symptom or couldn't get it going?

JW: Heck, the BPFTPServer executable is still G6FTPSrv.exe.