[isalist] Re: FTP Delete
- From: "Greg Mulholland" <greg@xxxxxxxxxxxxxx>
- To: <isalist@xxxxxxxxxxxxx>
- Date: Thu, 1 Jun 2006 07:25:47 +1000
http://www.ISAserver.org
-------------------------------------------------------
sniff your own steaming packets!
Greg Mulholland
----- Original Message -----
From: "Thomas W Shinder" <tshinder@xxxxxxxxxxx>
To: <isalist@xxxxxxxxxxxxx>
Sent: Thursday, June 01, 2006 7:14 AM
Subject: [isalist] Re: FTP Delete
http://www.ISAserver.org
-------------------------------------------------------
That would be a steaming pile of sniffed packets :)
Thomas W Shinder, M.D.
Site: www.isaserver.org
Blog: http://blogs.isaserver.org/shinder/
Book: http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
> -----Original Message-----
> From: isalist-bounce@xxxxxxxxxxxxx
> [mailto:isalist-bounce@xxxxxxxxxxxxx] On Behalf Of Jim Harrison
> Sent: Wednesday, May 31, 2006 3:53 PM
> To: isalist@xxxxxxxxxxxxx
> Subject: [isalist] Re: FTP Delete
>
> http://www.ISAserver.org
> -------------------------------------------------------
>
> Nothing says "aha!" like a steaming pile of packets...
>
> -------------------------------------------------------
> Jim Harrison
> MCP(NT4, W2K), A+, Network+, PCG
> http://isaserver.org/Jim_Harrison/
> http://isatools.org
> Read the help / books / articles!
> -------------------------------------------------------
>
>
> -----Original Message-----
> From: isalist-bounce@xxxxxxxxxxxxx
> [mailto:isalist-bounce@xxxxxxxxxxxxx] On Behalf Of Amy Babinchak
> Sent: Wednesday, May 31, 2006 13:28
> To: isalist@xxxxxxxxxxxxx
> Subject: [isalist] Re: FTP Delete
>
> http://www.ISAserver.org
> -------------------------------------------------------
>
> The SBS Internet Users rule allows the connections. The rule
> field is blank on the denies. But I'm not even sure that the
> deny packets that I have in the ISA server are relevant.
> There are only 2 of them and the FTP delete was tried
> multiple times by different people at different workstations.
>
> I'll be there tomorrow to get to the bottom of this. I'm
> thinking it's got to be a workstation thing.
>
> Amy
>
>
> -----Original Message-----
> From: isalist-bounce@xxxxxxxxxxxxx
> [mailto:isalist-bounce@xxxxxxxxxxxxx]
> On Behalf Of Thomas W Shinder
> Sent: Wednesday, May 31, 2006 4:20 PM
> To: isalist@xxxxxxxxxxxxx
> Subject: [isalist] Re: FTP Delete
>
> http://www.ISAserver.org
> -------------------------------------------------------
>
> Hi Amy,
>
> What rule denies the connections?
>
> What rule is allowing the connections?
>
> Thanks!
> Tom
>
> Thomas W Shinder, M.D.
> Site: www.isaserver.org
> Blog: http://blogs.isaserver.org/shinder/
> Book: http://tinyurl.com/3xqb7
> MVP -- ISA Firewalls
>
>
>
> > -----Original Message-----
> > From: isalist-bounce@xxxxxxxxxxxxx
> > [mailto:isalist-bounce@xxxxxxxxxxxxx] On Behalf Of Amy Babinchak
> > Sent: Wednesday, May 31, 2006 3:07 PM
> > To: isalist@xxxxxxxxxxxxx
> > Subject: [isalist] Re: FTP Delete
> >
> > http://www.ISAserver.org
> > -------------------------------------------------------
> >
> > I tried both. I can't remember now, which one works for them.
> > One works
> > except for the ability to delete files, the other mode
> doesn't work at
> > all.
> >
> > All users use the same FTP login creditentials.
> >
> > Amy
> >
> > -----Original Message-----
> > From: isalist-bounce@xxxxxxxxxxxxx
> > [mailto:isalist-bounce@xxxxxxxxxxxxx]
> > On Behalf Of Thomas W Shinder
> > Sent: Wednesday, May 31, 2006 4:03 PM
> > To: isalist@xxxxxxxxxxxxx
> > Subject: [isalist] Re: FTP Delete
> >
> > http://www.ISAserver.org
> > -------------------------------------------------------
> >
> > Do you know if they're using port or pasv mode?
> >
> > Thomas W Shinder, M.D.
> > Site: www.isaserver.org
> > Blog: http://blogs.isaserver.org/shinder/
> > Book: http://tinyurl.com/3xqb7
> > MVP -- ISA Firewalls
> >
> >
> >
> > > -----Original Message-----
> > > From: isalist-bounce@xxxxxxxxxxxxx
> > > [mailto:isalist-bounce@xxxxxxxxxxxxx] On Behalf Of Amy Babinchak
> > > Sent: Wednesday, May 31, 2006 3:01 PM
> > > To: isalist@xxxxxxxxxxxxx
> > > Subject: [isalist] Re: FTP Delete
> > >
> > > http://www.ISAserver.org
> > > -------------------------------------------------------
> > >
> > > External client works fine. I can delete from my office, no
> > problem.
> > >
> > > I don't know if they tried the command line FTP client. I
> doubt they
> > > would know how. I'll be there tomorrow to try it.
> > >
> > > Amy
> > >
> > >
> > >
> > >
> > > -----Original Message-----
> > > From: isalist-bounce@xxxxxxxxxxxxx
> > > [mailto:isalist-bounce@xxxxxxxxxxxxx]
> > > On Behalf Of Thomas W Shinder
> > > Sent: Wednesday, May 31, 2006 3:30 PM
> > > To: isalist@xxxxxxxxxxxxx
> > > Subject: [isalist] Re: FTP Delete
> > >
> > > http://www.ISAserver.org
> > > -------------------------------------------------------
> > >
> > > Have you tested from an external client?
> > >
> > > How about from the command line FTP client?
> > >
> > > Thanks!
> > > Tom
> > >
> > > Thomas W Shinder, M.D.
> > > Site: www.isaserver.org
> > > Blog: http://blogs.isaserver.org/shinder/
> > > Book: http://tinyurl.com/3xqb7
> > > MVP -- ISA Firewalls
> > >
> > > >
> > > > On 5/31/06 12:14 PM, "Amy Babinchak"
> > > <amy@xxxxxxxxxxxxxxxxxxxxxxxxxx>
> > > > spoketh to all:
> > > >
> > > > > http://www.ISAserver.org
> > > > > -------------------------------------------------------
> > > > >
> > > > > I have a client whose FTP site is hosted by SBC. Local
> > > > users are unable
> > > > > to delete files on the FTP site. They get a 550 access
> > > denied error.
> > > > > We've tried various FTP clients and IE with the same
> > > > results. All local
> > > > > PC's are XP SP2 running the firewall client. SBC insists
> > > > this is a local
> > > > > firewall issue. I'm not seeing it. Anyone think SBC's
> > > > diagnosis has any
> > > > > merit? The only thing that has me questioning myself is
> > > > that if I log
> > > > > onto the server as administrator and attempt to delete
> > > from the FTP
> > > > > site, I can.
> > > > >
> > > > > I have loads of successful FTP connections and only 2
> > > > denied packets in
> > > > > the last 24 hours. They look like this:
> > > > >
> > > > > Original Client IP Client Agent Authenticated Client Service
> > > > > Server Name Referring Server Destination Host Name Transport
> > > > > MIME Type Object Source Source Proxy Destination Proxy
> > > > > Bidirectional Client Host Name Filter Information Network
> > > > > Interface Raw IP Header Raw Payload Source Port
> Processing Time
> > > > > Bytes Sent Bytes Received Result Code Cache Information Log
> > > > > Record Type Log Time Destination IP Destination Port Protocol
> > > > > Action Rule Client IP Client Username Source Network
> Destination
> > > > > Network HTTP Method URL Error Information HTTP Status Code
> > > > > 70.229.250.114 - SVCTAG-H442T91 -
> > > > > TCP - - - -
> > > > > - - 1540 0 0 0 0xc0040017
> > > > > FWX_E_TCP_NOT_SYN_PACKET_DROPPED 0x0 Firewall
> > > > > 5/31/2006 9:25:26 AM 68.142.234.92 21 FTP Denied Connection -
> > > > > 70.229.250.114 - Local Host External 0x0 Amy
> > > > >
> > > > >
> > > > > ------------------------------------------------------
> > > > > List Archives: //www.freelists.org/archives/isalist/
> > > > > ISA Server Newsletter:
> > > http://www.isaserver.org/pages/newsletter.asp
> > > > > ISA Server Articles and Tutorials:
> > > > > http://www.isaserver.org/articles_tutorials/
> > > > > ISA Server Blogs: http://blogs.isaserver.org/
> > > > > ------------------------------------------------------
> > > > > Visit TechGenix.com for more information about our
> other sites:
> > > > > http://www.techgenix.com
> > > > > ------------------------------------------------------
> > > > > To unsubscribe visit
> http://www.isaserver.org/pages/isalist.asp
> > > > > Report abuse to listadmin@xxxxxxxxxxxxx
> > > > >
> > > > >
> > > > >
> > > >
> > > >
> > > > ------------------------------------------------------
> > > > List Archives: //www.freelists.org/archives/isalist/
> > > > ISA Server Newsletter:
> > > http://www.isaserver.org/pages/newsletter.asp
> > > > ISA Server Articles and Tutorials:
> > > > http://www.isaserver.org/articles_tutorials/
> > > > ISA Server Blogs: http://blogs.isaserver.org/
> > > > ------------------------------------------------------
> > > > Visit TechGenix.com for more information about our other sites:
> > > > http://www.techgenix.com
> > > > ------------------------------------------------------
> > > > To unsubscribe visit http://www.isaserver.org/pages/isalist.asp
> > > > Report abuse to listadmin@xxxxxxxxxxxxx
> > > >
> > > >
> > > >
> > > ------------------------------------------------------
> > > List Archives: //www.freelists.org/archives/isalist/
> > > ISA Server Newsletter:
> > http://www.isaserver.org/pages/newsletter.asp
> > > ISA Server Articles and Tutorials:
> > > http://www.isaserver.org/articles_tutorials/
> > > ISA Server Blogs: http://blogs.isaserver.org/
> > > ------------------------------------------------------
> > > Visit TechGenix.com for more information about our other sites:
> > > http://www.techgenix.com
> > > ------------------------------------------------------
> > > To unsubscribe visit http://www.isaserver.org/pages/isalist.asp
> > > Report abuse to listadmin@xxxxxxxxxxxxx
> > >
> > > ------------------------------------------------------
> > > List Archives: //www.freelists.org/archives/isalist/
> > > ISA Server Newsletter:
> > http://www.isaserver.org/pages/newsletter.asp
> > > ISA Server Articles and Tutorials:
> > > http://www.isaserver.org/articles_tutorials/
> > > ISA Server Blogs: http://blogs.isaserver.org/
> > > ------------------------------------------------------
> > > Visit TechGenix.com for more information about our other sites:
> > > http://www.techgenix.com
> > > ------------------------------------------------------
> > > To unsubscribe visit http://www.isaserver.org/pages/isalist.asp
> > > Report abuse to listadmin@xxxxxxxxxxxxx
> > >
> > >
> > >
> > ------------------------------------------------------
> > List Archives: //www.freelists.org/archives/isalist/
> > ISA Server Newsletter:
> http://www.isaserver.org/pages/newsletter.asp
> > ISA Server Articles and Tutorials:
> > http://www.isaserver.org/articles_tutorials/
> > ISA Server Blogs: http://blogs.isaserver.org/
> > ------------------------------------------------------
> > Visit TechGenix.com for more information about our other sites:
> > http://www.techgenix.com
> > ------------------------------------------------------
> > To unsubscribe visit http://www.isaserver.org/pages/isalist.asp
> > Report abuse to listadmin@xxxxxxxxxxxxx
> >
> > ------------------------------------------------------
> > List Archives: //www.freelists.org/archives/isalist/
> > ISA Server Newsletter:
> http://www.isaserver.org/pages/newsletter.asp
> > ISA Server Articles and Tutorials:
> > http://www.isaserver.org/articles_tutorials/
> > ISA Server Blogs: http://blogs.isaserver.org/
> > ------------------------------------------------------
> > Visit TechGenix.com for more information about our other sites:
> > http://www.techgenix.com
> > ------------------------------------------------------
> > To unsubscribe visit http://www.isaserver.org/pages/isalist.asp
> > Report abuse to listadmin@xxxxxxxxxxxxx
> >
> >
> >
> ------------------------------------------------------
> List Archives: //www.freelists.org/archives/isalist/
> ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
> ISA Server Articles and Tutorials:
> http://www.isaserver.org/articles_tutorials/
> ISA Server Blogs: http://blogs.isaserver.org/
> ------------------------------------------------------
> Visit TechGenix.com for more information about our other sites:
> http://www.techgenix.com
> ------------------------------------------------------
> To unsubscribe visit http://www.isaserver.org/pages/isalist.asp
> Report abuse to listadmin@xxxxxxxxxxxxx
>
> ------------------------------------------------------
> List Archives: //www.freelists.org/archives/isalist/
> ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
> ISA Server Articles and Tutorials:
> http://www.isaserver.org/articles_tutorials/
> ISA Server Blogs: http://blogs.isaserver.org/
> ------------------------------------------------------
> Visit TechGenix.com for more information about our other sites:
> http://www.techgenix.com
> ------------------------------------------------------
> To unsubscribe visit http://www.isaserver.org/pages/isalist.asp
> Report abuse to listadmin@xxxxxxxxxxxxx
>
>
> All mail to and from this domain is GFI-scanned.
>
> ------------------------------------------------------
> List Archives: //www.freelists.org/archives/isalist/
> ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
> ISA Server Articles and Tutorials:
> http://www.isaserver.org/articles_tutorials/
> ISA Server Blogs: http://blogs.isaserver.org/
> ------------------------------------------------------
> Visit TechGenix.com for more information about our other sites:
> http://www.techgenix.com
> ------------------------------------------------------
> To unsubscribe visit http://www.isaserver.org/pages/isalist.asp
> Report abuse to listadmin@xxxxxxxxxxxxx
>
>
>
------------------------------------------------------
List Archives: //www.freelists.org/archives/isalist/
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server Articles and Tutorials:
http://www.isaserver.org/articles_tutorials/
ISA Server Blogs: http://blogs.isaserver.org/
------------------------------------------------------
Visit TechGenix.com for more information about our other sites:
http://www.techgenix.com
------------------------------------------------------
To unsubscribe visit http://www.isaserver.org/pages/isalist.asp
Report abuse to listadmin@xxxxxxxxxxxxx
------------------------------------------------------
List Archives: //www.freelists.org/archives/isalist/
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server Articles and Tutorials: http://www.isaserver.org/articles_tutorials/
ISA Server Blogs: http://blogs.isaserver.org/
------------------------------------------------------
Visit TechGenix.com for more information about our other sites:
http://www.techgenix.com
------------------------------------------------------
To unsubscribe visit http://www.isaserver.org/pages/isalist.asp
Report abuse to listadmin@xxxxxxxxxxxxx
Other related posts:
