FTP Uploads over 500kb fail

[gtrscott]

FTP Site has been working for several months. Now file uploads fail. I've included wireshark packet sample at the end. Windows 2003 SP2 with updates current and IIS 6. I'm testing on the same subnet as the server so no routers between me and the server, firewall service is stopped and as you can see below, some data transfers and then it stops and deletes what was downloaded. I've tried WSFTP and Win Explorer for clients.

Thanks in Advance!

15790 58.125874 10.1.21.6 10.1.21.40 FTP-DATA FTP Data: 1460 bytes
15791 58.125897 10.1.21.6 10.1.21.40 FTP-DATA FTP Data: 1460 bytes
15792 58.125913 10.1.21.6 10.1.21.40 FTP-DATA FTP Data: 1176 bytes
15793 58.125939 10.1.21.40 10.1.21.6 TCP 5535 > stvp [ACK] Seq=1 Ack=851969 Win=32767 Len=0
15794 58.126021 10.1.21.6 10.1.21.40 FTP-DATA FTP Data: 1460 bytes
15795 58.126049 10.1.21.6 10.1.21.40 FTP-DATA FTP Data: 1460 bytes
15796 58.126066 10.1.21.6 10.1.21.40 FTP-DATA FTP Data: 1176 bytes
15797 58.126079 10.1.21.6 10.1.21.40 FTP-DATA FTP Data: 1460 bytes
15798 58.126115 10.1.21.40 10.1.21.6 TCP 5535 > stvp [ACK] Seq=1 Ack=857525 Win=27211 Len=0
15799 58.126131 10.1.21.6 10.1.21.40 FTP-DATA FTP Data: 1460 bytes
15800 58.126132 10.1.21.40 10.1.21.6 TCP 5535 > stvp [FIN, ACK] Seq=1 Ack=857525 Win=27211 Len=0
15801 58.126156 10.1.21.6 10.1.21.40 FTP-DATA FTP Data: 1176 bytes
15802 58.126166 10.1.21.6 10.1.21.40 FTP-DATA FTP Data: 1460 bytes
15803 58.126177 10.1.21.6 10.1.21.40 FTP-DATA FTP Data: 1460 bytes
15804 58.126199 10.1.21.40 10.1.21.6 TCP 5535 > stvp [RST, ACK] Seq=2 Ack=863081 Win=0 Len=0
15805 58.126254 10.1.21.6 10.1.21.40 FTP-DATA FTP Data: 1176 bytes
15806 58.126284 10.1.21.40 10.1.21.6 TCP 5535 > stvp [RST] Seq=1 Win=0 Len=0
15833 58.222036 10.1.21.6 10.1.21.40 TCP ariliamulti > ftp [ACK] Seq=630 Ack=1853 Win=65384 Len=0
15834 58.222115 10.1.21.40 10.1.21.6 FTP Response: 426 Connection closed; transfer aborted.
15835 58.222744 10.1.21.6 10.1.21.40 TCP navegaweb-port > ftp [SYN] Seq=0 Win=65535 Len=0 MSS=1460
15836 58.222790 10.1.21.40 10.1.21.6 TCP ftp > navegaweb-port [SYN, ACK] Seq=0 Ack=1 Win=16384 Len=0 MSS=1460
15837 58.222893 10.1.21.6 10.1.21.40 TCP navegaweb-port > ftp [ACK] Seq=1 Ack=1 Win=65535 Len=0
15838 58.223077 10.1.21.40 10.1.21.6 FTP Response: 220 Microsoft FTP Service
15839 58.223313 10.1.21.6 10.1.21.40 FTP Request: USER wrcaltrans
15840 58.223405 10.1.21.40 10.1.21.6 FTP Response: 331 Password required for wrcaltrans.
15841 58.223625 10.1.21.6 10.1.21.40 FTP Request: PASS ******
15842 58.224347 10.1.21.40 10.1.21.6 FTP Response: 230 User wrcaltrans logged in.
15843 58.224592 10.1.21.6 10.1.21.40 FTP Request: opts utf8 on
15844 58.224697 10.1.21.40 10.1.21.6 FTP Response: 501 option not supported
15845 58.224921 10.1.21.6 10.1.21.40 FTP Request: PWD
15846 58.225024 10.1.21.40 10.1.21.6 FTP Response: 257 "/wrcaltrans" is current directory.
15847 58.225266 10.1.21.6 10.1.21.40 FTP Request: CWD /wrcaltrans/Other/
15848 58.225602 10.1.21.40 10.1.21.6 FTP Response: 250 CWD command successful.
15849 58.225860 10.1.21.6 10.1.21.40 FTP Request: DELE DoubleTake_i386_5.1.1.1136.11.exe
15850 58.226923 10.1.21.40 10.1.21.6 FTP Response: 250 DELE command successful.
15944 58.425167 10.1.21.6 10.1.21.40 TCP ariliamulti > ftp [ACK] Seq=630 Ack=1895 Win=65342 Len=0
15945 58.425211 10.1.21.6 10.1.21.40 TCP navegaweb-port > ftp [ACK] Seq=114 Ack=225 Win=65311 Len=0

 

[fxthoth]

Maybe it blocks antivirus or antispyware. Or net hardware like UTM.

Try upload it to localhost at the same computer.

 

[gtrscott]

Thanks, I solved it. The ftp user had a disk quota set and it was reached.

 

[fxthoth]

Great.