Fortran - O/T: Wierd FTP interrupts

Author

O/T: Wierd FTP interrupts - please help

Random Programmer

2005-08-21, 9:56 pm

Hi guys. I posted this in the Linux & comp hardware newsgroup and
didn't get any joy. To be honest I have no idea how to start fixing
this problem, so I will try my luck here and see if anyone has
encountered this wierd problem before. I've found you guys quite
knowledgeable - so please excuse my O/T post.

For some reason, a file transfer just stops dead after a while.
Sometimes it restarts itself after a random time. It appears to halt
transfer at random progress percentages.

I have tried WinSCP, WS-FTP and FileZilla. The latter two are unable to
establish a connection to my college PC. WinSCP can, but has the above
problem.

I've also downloaded pscp to try from the MS-DOS command prompt - same
problem with WinSCP. The download gets 'stuck' at some value and my
internet connection is 100% idle when it happens.

I get the same problem when I reboot my computer and use the "scp"
command from SuSE 9.2 (I have a dual boot machine). Connection starts
OK and then suddenly dies out.

Interestingly, I *still* get the problem while transferring files over
my home network's LAN. So I know it can't be internet traffic issues,
my ADSL modem or a dodgy network card.

I ran a continuous ping between my home/college PC and even though the
FTP connection stops, the pings continued OK. Occasionally though,
pings were lost (Request timed out). This happened about 1-2% of the
time. Not sure if the lost packets are related. My average ping time to
college is about 31ms.

This problem is driving me nuts, it I only managed to transfer a few
megabytes in two hours on an ADSL connection. The rest of the time the
connection is idle. If I want to download anything large I must babysit
the connection and keep on reconnecting.

Any ideas what might be causing the sudden stops of my file
transferring?

I've uploaded pictures of the errors:

www.geocities.com/nonexistent2032/pscp_error.jpg
www.geocities.com/nonexistent2032/winscp_error.jpg

As a sidenote, anyone know why Paint must contact Akamai (195 . 22 .
198 . 134) before it saves screenshots to disk? Unless I open my
firewall for Paint, it refuses to save the screenshots.

And yes, my computer has been acting wierd of late. Strange hangs,
bugs, etc. Adaware crashes after a scan & Spybot detects no major
problems (just tracking cookies). I've run memtestx86 overnight, and no
problems.

Sorry if I seem to be giving superfluous information, I'm just trying
to tell you everything that might be related.

Thanks.

Random Programmer

2005-08-21, 9:56 pm

Oh, I forgot to mention, in the first picture (the PSCP error), note
the huge differences in average transfer rates, even though the file
sizes are similar. I wasn't multitasking with another bandwidth hogging
program. The differences you see there are due to the "random idle
time" problem.

Random Programmer

2005-08-21, 9:56 pm

Here is what happens when you leave the idle connection for too long:

"Fatal: Network Error: Software caused connection abort."

www.geocities.com/nonexistent2 032/pscp_error2.jpg

Random Programmer

2005-08-22, 3:57 am

Damn, another wierd error turned up.

I got a message about an application svchost.exe

It said an instruction at 0x77bd3143 tried to reference memory at
0x77bd3143 (I double checked the numbers), and caused an error.

Soon after that my computer became very sluggish. No response from task
manager or any buttons, although the mouse's movement was fine. Upon
reset, the event viewer log reported no errors (!!!)

In SuSE Linux, sometimes while doing simple tasks like copying files,
my system load (not CPU usage) would slowly increase to 100%, and then
crash. I'm not quite sure how system load is calculated, but I have
never seen it go beyond 50% even with full CPU utilisation.

Gordon Sande

2005-08-22, 7:57 am

On 2005-08-21 23:45:04 -0300, "Random Programmer"
<nonexistent2032@yahoo.co.uk> said:

> For some reason, a file transfer just stops dead after a while.
> Sometimes it restarts itself after a random time. It appears to halt
> transfer at random progress percentages.

It has been my experience with four ISPs over both dial-up and cable
modem connections that downloads tend to be very variable both in their
speed and the spottiness of full rate transfers. I have always presumed
it was related to the source scheduling algorithms with perhaps some
issues of internet routing as well. The problem was worse with dial-ups
so I guessed that if the source ever slowed back it tended to get swapped
out and there was no great hurry to get things going again.

Friends on faculty at a couple places tell stories of their institutions
deliberately having slow connections to the main backbones to try to
slow the massive transferring of copyright^H^H^H^H^H^H^H^H
violations^H^H^H^H^H^H^H^H^H^H MP3 music and such by students.
Routers can even be tuned to provide differing quality of service
for differing IP services but that takes much more fuss than
most are willing go to. Easier to just put in a slow link.

> As a sidenote, anyone know why Paint must contact Akamai (195 . 22 .
> 198 . 134) before it saves screenshots to disk? Unless I open my
> firewall for Paint, it refuses to save the screenshots.

Some programs have a "check for updates" feature but that tends to
cause the "call home" on startup. Usually there is an option for
everytime, once a while or never. Another cure for rampant virus
and malware problems is to get a Mac. ;-)

Random Programmer

2005-08-22, 7:02 pm

Hi Gordon. Thanks for the input. You're the 2nd guy to reply to me
after 3 posts on 3 high activity newsgroups :O

I don't think it is an internet connectivity issue...I get this problem
even on my home LAN which has a direct computer-computer connect (no
router). It probably isn't a network card issue either, my ADSL USB
modem also has the same problems and it goes straight into my phone
socket (after the ADSL filter).

My university does implement bandwidth restrictions on some
internal->external IPs (especially undergrads & student halls) but
being a postgrad with a static IP and a computer I am responsible for
means I don't do any file sharing with it. Some of my friends do on
their PCs though, but IMVHO that can lead to serious trouble as you
pointed out.

Although others have physical access to my work PC (shared postgrad
room), it is probably secure. It runs SuSE linux and I only shared the
root password with the Comp Services admin for a day or so (they wanted
to check my firewall settings) and then I changed the password.

I also queried my IT services about this and they said no bandwidth
throttling services applied to me.

I know about this call home feature, but I've never experienced it with
MS Paint. It also seems strange that it would only be calling home when
I am trying to save a screendump (nothing else) and not on startup.

I don't think it is a malware problem -- "netstat -n" doesn't report
any ports being opened to addresses I don't recognise, I don't have any
dodgy popups/browser hijacks, on startup I only have 23 processes
running (including firewall + antivirus, and no unrecognised ones), I
get these issues in SuSE Linux as well, etc...

IMVHO for a rogue process to be running on my PC, it would have to be
present in both Windows/Linux O/Ses, be somehow responsible for the FTP
stalling, be so stealthed that "netstat -n", task manager, msconfig and
my Windows firewall, Linux's netstat etc. don't detect it...(highly
unlikely!)

Do you have any other thoughts?

Thanks.

James Van Buskirk

2005-08-22, 7:02 pm

"Random Programmer" <nonexistent2032@yahoo.co.uk> wrote in message
news:1124718990.905914.28780@g49g2000cwa.googlegroups.com...

> IMVHO for a rogue process to be running on my PC, it would have to be
> present in both Windows/Linux O/Ses, be somehow responsible for the FTP
> stalling, be so stealthed that "netstat -n", task manager, msconfig and
> my Windows firewall, Linux's netstat etc. don't detect it...(highly
> unlikely!)

Unlikely perhaps for a randomly generated process, but quite the
norm for malware. Have you posted the HijackThis log file to a
security forum? You haven't even posted the version of 'doze
in use -- you know about the worm that knocked down CNN the other
day (Win2K), right?

BTW, the only time I had a download get dropped repeatedly was
when I was attempting to get the AlphaNT version of the Java
development kit. Turned out that there wasn't enough space
on the current partition to store the temporary copy that
Windows makes. Not easy to figure it out from the error
message, though.

--
write(*,*) transfer((/17.392111325966148d0,6.5794487871554595D-85, &
6.0134700243160014d-154/),(/'x'/)); end

Random Programmer

2005-08-22, 7:02 pm

Hi James. Thanks for your reply. I'll post my HijackThis log file onto
a security forum to see if anything turns up, but I recognise/have
Googled all the running processes and registry keys. I will try
emptying my temporary folder and see if it helps.

The O/Ses I'm using:
Main home PC: Win XP Professional, dual boot with 32-bit SuSE 9.2
Second home PC: Win XP Professional, dual boot with Red Hat 9.0
Work PC: 64-bit SuSE 9.2

The problem appears to be quite O/S independent.

I've helped to fix friends computers with malware on it, and usually
when they sabotage key system files like Task Manager/msconfig/regedit,
they just prevent it from running (instead of "spoofing" the Task
Manager's output, assuming of course that is what is happening here).

dooleys@snowy.net.au

2005-08-22, 7:02 pm

try using ttcp/ttcpw at each end to test the throughput with various
transfer sizes
Phil

Jan Vorbrüggen

2005-08-23, 7:57 am

There are some incompatibilities in the implementation of the FTP protocol
on the two sides of the link that can get you into a stalled connection -
sorry, not details available. Another thing to test might be to toggle
into passive mode (actual data tranfer is done in the "other" direction
than for traditional FTP).

Jan

[JvO]

2005-08-23, 7:00 pm

Random Programmer schreef:

> Damn, another wierd error turned up.
>
> I got a message about an application svchost.exe

This makes me think of the Sasser virus
I had a few months ago on Win XP.

[JvO]

> It said an instruction at 0x77bd3143 tried to reference memory at
> 0x77bd3143 (I double checked the numbers), and caused an error.
>
> Soon after that my computer became very sluggish. No response from task
> manager or any buttons, although the mouse's movement was fine. Upon
> reset, the event viewer log reported no errors (!!!)
>
> In SuSE Linux, sometimes while doing simple tasks like copying files,
> my system load (not CPU usage) would slowly increase to 100%, and then
> crash. I'm not quite sure how system load is calculated, but I have
> never seen it go beyond 50% even with full CPU utilisation.

Random Programmer

2005-08-23, 7:00 pm

I scan my PC almost daily (just leave it overnight doing it), not that
I engage in any high risk activities which would let a virus in. Not to
boast while I am apparently standing on a sinking ship, but I've found
Firefox-Sygate Personal Firewall-Grisoft's AVG a good combination.

Random Programmer

2005-08-23, 7:00 pm

BTW, I cleared the temporary files (had 1.9GB of it!!) to no effect. So
the problem is elsewhere...

Random Programmer

2005-08-23, 7:00 pm

Jan Vorbr=FCggen wrote:
> There are some incompatibilities in the implementation of the FTP protocol
> on the two sides of the link that can get you into a stalled connection -
> sorry, not details available.

Hiya Jan. Thanks for replying. Would this affect a SuSE 9.2 (32 bit) to
a SuSE 9.2 (64 bit) connection? I get the same problem there as well,
as well as a Win XP - Red Hat 9.0 connection and Win XP - SuSE 9.2 (64
bit) connection.

> Another thing to test might be to toggle
> into passive mode (actual data tranfer is done in the "other" direction
> than for traditional FTP).
>

Doesn't look like WinSCP or PSCP in Windows or SCP in Linux offers this
option. I will look around for other FTP managers that do.

Random Programmer

2005-08-23, 7:00 pm

Hiya Phil. I'll try this tonight and post feedback here on what
happens.

Sponsored Links