[PLUG] Deciphering ethereal capture

[Rich Shepard]

On Tue, 25 Jun 2002, Steve Bonds wrote:

> The symptoms describe almost perfectly a case of trying to run a
> non-passive FTP through a firewall.  As soon as FTP tries to open up the
> data port from the server back to your computer (after the initial control
> connection) it hangs.  The "ls" command triggers it.
> 
> Make sure that your ~/.ncftp/prefs file is set up for passive mode only.

Steve,

  I understand this. Both ncftp and ftp are set in passive mode, and they
worked just fine for a couple of years. This is a behavior new within the
past couple of months. That's what's so puzzling.
 
> PS: SANS has a class with a large portion devoted to learning how to read
> packet captures.  http://www.sans.org/onlinetraining/track3.php

  Thank you.

Rich