iptraf and port 20?

Timon79 · 01-12-2003, 11:45 AM

Hi,

I have set up iptraf to run in the background and log all packets from/to eth0 to a logfile ( iptaf -s eth0 -B ). Everythings works fine, but traffic on port 20 ( ftp data ) is _not_ beeing logged! Why? Port 21, 22, 25, 80, ... works fine.

Maybe someone can help
Thanks

mcleodnine · 01-12-2003, 01:37 PM

Are you using passive mode ftp?

Timon79 · 01-12-2003, 02:18 PM

I don't know. How can i find out?

Here's the log from my client when I connect to the ftp server.

Quote:

230 Login successful. Have fun.
SYST
215 UNIX Type: L8
REST 100
350 Restart position accepted.
REST 0
350 Restart position accepted.
PWD
257 "/"
TYPE A
200 ASCII tastes bad, dude.
PASV
227 Entering Passive Mode (213,83,55,54,192,29)
LIST
150 Here comes the directory listing.
226 Directory send OK.

So, I think yes, I'm using passive mode

mcleodnine · 01-12-2003, 02:50 PM

From "Building Linux and OpenBSD Firewalls" (Sonnenreich, Yates) Wiley Press

Quote:

In passive mode the command channel is still port 21 on the server but the traditional data channel on port 20 is not used. Instead, when the client requests passive mode the server picks an unused local TCP port between port 1024 and 65535 and tells the client."

Timon79 · 01-12-2003, 03:20 PM

ok, danke.....jetzt weiss ich schonmal warum ftp-data in meinem logfile nicht auftaucht. Kann ich meinen ftp-server zwingen, bestimmte ports zu benutzen, sodass ich die dann mitloggen kann? Ich hab vsftpd laufen.