[sclug] ftp woes

[sclug at whittycat.me.uk]

I'm going to need some help with this one. I have just moved to Somerset
and now enjoy broadband from plusnet [Red Hat 8.0 -> ethernet modem -> ADSL]
which is ok up to a point. Mozilla works but ftp doesn't and I need to
update my web sites. (Is there a way of uploading files with Mozilla? that
would do to be going on with.) What happens is that I type 

ftp ftp.plus.net 

get a prompt back, type the username, then nothing whatever happens until
it times out. Other ftp sites like metalab.unc.edu do the same. I looked
at the packets going to and fro with tcpdump but they don't really tell
me what is happening. They start with a lot of dialogue to establish a
connection ending with their end saying 

Plus.Net FTP Server #1 Ready 

viz 


17:31:42.475121 homepages.plus.net.ftp > whittycat.plus.com.33172:
 P 468:502(34) ack 1 win 57482 <nop,nop,timestamp 431984968 3173840> (DF)
 [tos 0xa0]
E..V.W at .8.).....P.............T.....|..........H.0m.220.Plus.Net
.FTP.Server.#1.ready.. 

17:31:42.475165 whittycat.plus.com.33172 > homepages.plus.net.ftp:
 . ack 502 win 5840 <nop,nop,timestamp 3173845 431984968> (DF)
 [tos 0x10]
E..49a at .@..DP.............T..................0m....H 

At this point I get 'Name: (ftp.plus.net:solon):' on the screen but there
is no packet that contains this so it seems to be generated locally. 

I send my username: 'Name: (ftp.plus.net:solon): whittycat' 

but before this gets sent their end starts its chat again and gets only
partly through it when my username packet gets sent: 

17:31:43.650695 homepages.plus.net.ftp > whittycat.plus.com.33172:
 P 1:502(501) ack 1 win 57482 <nop,nop,timestamp 431985087 3173840> (DF)
 [tos 0xa0]
E..).. at .8.%[....P.............T.....g............0m.220-..220-PL
EASE.NOTE:.If.you.have.a.non-subscription.account.you..220-will.
only.be.able.to.login.to.this.ftp.server.if.you.are..220-dialled
.into.our.network...220-..220-ALSO:.If.you.upload. 

17:31:43.650769 whittycat.plus.com.33172 > homepages.plus.net.ftp:
 . ack 502 win 5840 <nop,nop,timestamp 3173963 431985087> (DF)
 [tos 0x10]
E..49b at .@..CP.............T..................0nK.... 

17:31:45.853371 homepages.plus.net.ftp > whittycat.plus.com.33172:
 P 1:502(501) ack 1 win 57482 <nop,nop,timestamp 431985307 3173840> (DF)
 [tos 0xa0]
E..).. at .8.!.....P.............T.....f............0m.220-..220-PL
EASE.NOTE:.If.you.have.a.non-subscription.account.you..220-will.
only.be.able.to.login.to.this.ftp.server.if.you.are..220-dialled
.into.our.network...220-..220-ALSO:.If.you.upload. 

17:31:45.853447 whittycat.plus.com.33172 > homepages.plus.net.ftp:
 . ack 502 win 5840 <nop,nop,timestamp 3174183 431985307> (DF)
 [tos 0x10]
E..49c at .@..BP.............T..........h.......0o'.... 


17:31:46.883155 whittycat.plus.com.33172 > homepages.plus.net.ftp:
 P 1:17(16) ack 502 win 5840 <nop,nop,timestamp 3174286 431985307> (DF)
 [tos 0x10]
E..D9d at .@..1P.............T.........}........0o.....USER.whittyc
at.. 

17:31:47.109813 whittycat.plus.com.33172 > homepages.plus.net.ftp:
 P 1:17(16) ack 502 win 5840 <nop,nop,timestamp 3174309 431985307> (DF)
 [tos 0x10]
E..D9e at .@..0P.............T.........|........0o.....USER.whittyc
at.. 

but it gets sent twice with no ack from their end and then something
really strange: 

17:31:47.329786 arp who-has pth-cdns01.plus.net tell whittycat.plus.com
......... at .XJPP............1 

17:31:47.330053 arp reply pth-cdns01.plus.net is-at 0:d:88:6e:57:5e
...........nW^...1. at .XJPP..................... 

(pth* is the name server and whittycat.plus.com is my hostname. The mac
address belongs to the ethernet modem.) 

The username is then sent again: 

17:31:47.569800 whittycat.plus.com.33172 > homepages.plus.net.ftp:
 P 1:17(16) ack 502 win 5840 <nop,nop,timestamp 3174355 431985307> (DF)
 [tos 0x10]
E..D9f at .@../P.............T.........|........0o.....USER.whittyc
at.. 

17:31:48.010039 whittycat.plus.com.bootpc > 192.168.1.1.bootps:
 xid:0x6261243b C:whittycat.plus.com [|bootp] (DF)
E..H.. at .@.H.P........D.C.4......ba$;....P................ at .XJP..
................................................................
................................................................
.................................................. 

and at this point I am quite lost. What is bootp doing? 192.168.1.1 is
the address of the modem. Can anyone throw some light on this murky area
and what can I do to get some more information about what is happening? 

btw in all other matters Somerset is delightful and we've missed Reading's
torrential rain. 

Tony Sumner