在Windows Server 2008 R2 Standard机器上，我无法连接到Windows FTP服务器并从中下载文件。
文件大小是〜3KB到6KB。 很less~100KB到〜500KB，但是服务器在磁盘上有足够的空间。
我试过了一个被动连接：
Response: 220-Microsoft FTP Service Response: 220 Regal Logistics Command: USER ******** Response: 331 Password required for ********. Command: PASS ******** Response: 230 User ******** logged in. Status: Connected Status: Starting download of /********/PO/201405130227.xml Command: CWD /********/PO Response: 250 CWD command successful. Command: TYPE A Response: 200 Type set to A. Command: PASV Response: 227 Entering Passive Mode (***,***,***,**,19,64) Command: RETR 201405130227.xml Response: 125 Data connection already open; Transfer starting. Response: 426 Data connection closed. Error scanning content Error: File transfer failed after transferring 3,465 bytes in 1 second 奇怪的是，这个文件是3,465字节，所以整个文件正在通过，只是没有正确完成。
我试过了一个活跃的连接：
Response: 220-Microsoft FTP Service Response: 220 Regal Logistics Command: USER ******** Response: 331 Password required for ********. Command: PASS ******** Response: 230 User ******** logged in. Command: PORT 10,0,0,114,214,65 Response: 200 PORT command successful. Command: RETR 201405130227.xml Response: 150 Opening ASCII mode data connection for 201405130227.xml(3465 bytes). Response: 426 Data connection closed. Error scanning content
我已经尝试了从同一台服务器上的两个不同的FTP客户端（Filezilla和CLI FTP客户端），我得到了相同的响应：
125 Data connection already open; Transfer starting. 426 Data connection closed. Error scanning content
我试图从一个单独的networking成功下载文件，所以它是唯一的服务器的位置。
我已经联系了服务器所在的系统/networkingpipe理员，并且我已经确认FTP所需的端口是开放的。 （我的猜测是，他们已经打开了21个，我不确定其他任何人）。他们的networking上有一个物理防火墙，但是我不幸的是没有访问它。 Windows防火墙在服务器上被禁用。
我还有什么可以看看是否真的失败？
以下是失败之前请求的数据包日志：
No. Time Source Destination Protocol Length Info 39 6.878855000 LOCAL-IP EXTERNAL-FTP-SERVER-IP FTP 77 Request: RETR 201405130227.xml Frame 39: 77 bytes on wire (616 bits), 77 bytes captured (616 bits) on interface 0 Ethernet II, Src: Hewlett-_ab:cd:ef (00:1e:a1:ab:cd:ef), Dst: Watchgua_12:34:56 (ab:cd:7f:12:34:56) Internet Protocol Version 4, Src: LOCAL-IP (LOCAL-IP), Dst: EXTERNAL-FTP-SERVER-IP (EXTERNAL-FTP-SERVER-IP) Transmission Control Protocol, Src Port: 56623 (56623), Dst Port: ftp (21), Seq: 55, Ack: 207, Len: 23 File Transfer Protocol (FTP) No. Time Source Destination Protocol Length Info 40 6.893662000 EXTERNAL-FTP-SERVER-IP LOCAL-IP TCP 60 ftp > 56623 [ACK] Seq=207 Ack=78 Win=93362 Len=0 Frame 40: 60 bytes on wire (480 bits), 60 bytes captured (480 bits) on interface 0 Ethernet II, Src: Watchgua_12:34:56 (ab:cd:7f:12:34:56), Dst: Hewlett-_ab:cd:ef (00:1e:a1:ab:cd:ef) Internet Protocol Version 4, Src: EXTERNAL-FTP-SERVER-IP (EXTERNAL-FTP-SERVER-IP), Dst: LOCAL-IP (LOCAL-IP) Transmission Control Protocol, Src Port: ftp (21), Dst Port: 56623 (56623), Seq: 207, Ack: 78, Len: 0 No. Time Source Destination Protocol Length Info 41 6.957666000 EXTERNAL-FTP-SERVER-IP LOCAL-IP FTP 108 Response: 125 Data connection already open; Transfer starting. Frame 41: 108 bytes on wire (864 bits), 108 bytes captured (864 bits) on interface 0 Ethernet II, Src: Watchgua_12:34:56 (ab:cd:7f:12:34:56), Dst: Hewlett-_ab:cd:ef (00:1e:a1:ab:cd:ef) Internet Protocol Version 4, Src: EXTERNAL-FTP-SERVER-IP (EXTERNAL-FTP-SERVER-IP), Dst: LOCAL-IP (LOCAL-IP) Transmission Control Protocol, Src Port: ftp (21), Dst Port: 56623 (56623), Seq: 207, Ack: 78, Len: 54 File Transfer Protocol (FTP) No. Time Source Destination Protocol Length Info 42 6.986757000 EXTERNAL-FTP-SERVER-IP LOCAL-IP FTP 106 Response: 426 Data connection closed. Error scanning content Frame 42: 106 bytes on wire (848 bits), 106 bytes captured (848 bits) on interface 0 Ethernet II, Src: Watchgua_12:34:56 (ab:cd:7f:12:34:56), Dst: Hewlett-_ab:cd:ef (00:1e:a1:ab:cd:ef) Internet Protocol Version 4, Src: EXTERNAL-FTP-SERVER-IP (EXTERNAL-FTP-SERVER-IP), Dst: LOCAL-IP (LOCAL-IP) Transmission Control Protocol, Src Port: ftp (21), Dst Port: 56623 (56623), Seq: 261, Ack: 78, Len: 52 File Transfer Protocol (FTP) No. Time Source Destination Protocol Length Info 43 6.986768000 LOCAL-IP EXTERNAL-FTP-SERVER-IP TCP 54 56623 > ftp [ACK] Seq=78 Ack=313 Win=65280 Len=0 Frame 43: 54 bytes on wire (432 bits), 54 bytes captured (432 bits) on interface 0 Ethernet II, Src: Hewlett-_ab:cd:ef (00:1e:a1:ab:cd:ef), Dst: Watchgua_12:34:56 (ab:cd:7f:12:34:56) Internet Protocol Version 4, Src: LOCAL-IP (LOCAL-IP), Dst: EXTERNAL-FTP-SERVER-IP (EXTERNAL-FTP-SERVER-IP) Transmission Control Protocol, Src Port: 56623 (56623), Dst Port: ftp (21), Seq: 78, Ack: 313, Len: 0
我收集了更多的日志 – 这次我观看的不止是端口21和22 – 我观看了FTP连接的IP：
No. Time Source Destination Protocol Length Info 2607 11.440148000 __REMOTE__IP__ _LOCAL_IP_ FTP 105 Response: 227 Entering Passive Mode (198,104,198,16,17,233) Frame 2607: 105 bytes on wire (840 bits), 105 bytes captured (840 bits) on interface 0 Ethernet II, Src: Watchgua_LOCALMAC (AA:BB:CC:LOCALMAC), Dst: Hewlett-_SUB_MAC (11:22:33:SUB_MAC) Internet Protocol Version 4, Src: __REMOTE__IP__ (__REMOTE__IP__), Dst: _LOCAL_IP_ (_LOCAL_IP_) Transmission Control Protocol, Src Port: ftp (21), Dst Port: 54613 (54613), Seq: 195, Ack: 60, Len: 51 File Transfer Protocol (FTP) No. Time Source Destination Protocol Length Info 2608 11.440763000 _LOCAL_IP_ __REMOTE__IP__ FTP 74 Request: RETR testthing.txt Frame 2608: 74 bytes on wire (592 bits), 74 bytes captured (592 bits) on interface 0 Ethernet II, Src: Hewlett-_SUB_MAC (11:22:33:SUB_MAC), Dst: Watchgua_LOCALMAC (AA:BB:CC:LOCALMAC) Internet Protocol Version 4, Src: _LOCAL_IP_ (_LOCAL_IP_), Dst: __REMOTE__IP__ (__REMOTE__IP__) Transmission Control Protocol, Src Port: 54613 (54613), Dst Port: ftp (21), Seq: 60, Ack: 246, Len: 20 File Transfer Protocol (FTP) No. Time Source Destination Protocol Length Info 2609 11.441029000 _LOCAL_IP_ __REMOTE__IP__ TCP 66 54617 > 4585 [SYN] Seq=0 Win=65535 Len=0 MSS=1460 WS=128 SACK_PERM=1 Frame 2609: 66 bytes on wire (528 bits), 66 bytes captured (528 bits) on interface 0 Ethernet II, Src: Hewlett-_SUB_MAC (11:22:33:SUB_MAC), Dst: Watchgua_LOCALMAC (AA:BB:CC:LOCALMAC) Internet Protocol Version 4, Src: _LOCAL_IP_ (_LOCAL_IP_), Dst: __REMOTE__IP__ (__REMOTE__IP__) Transmission Control Protocol, Src Port: 54617 (54617), Dst Port: 4585 (4585), Seq: 0, Len: 0 No. Time Source Destination Protocol Length Info 2610 11.442013000 __REMOTE__IP__ _LOCAL_IP_ TCP 60 ftp > 54613 [ACK] Seq=246 Ack=80 Win=93360 Len=0 Frame 2610: 60 bytes on wire (480 bits), 60 bytes captured (480 bits) on interface 0 Ethernet II, Src: Watchgua_LOCALMAC (AA:BB:CC:LOCALMAC), Dst: Hewlett-_SUB_MAC (11:22:33:SUB_MAC) Internet Protocol Version 4, Src: __REMOTE__IP__ (__REMOTE__IP__), Dst: _LOCAL_IP_ (_LOCAL_IP_) Transmission Control Protocol, Src Port: ftp (21), Dst Port: 54613 (54613), Seq: 246, Ack: 80, Len: 0 No. Time Source Destination Protocol Length Info 2622 11.459434000 __REMOTE__IP__ _LOCAL_IP_ TCP 66 4585 > 54617 [SYN, ACK] Seq=0 Ack=1 Win=65535 Len=0 WS=2 MSS=1400 SACK_PERM=1 Frame 2622: 66 bytes on wire (528 bits), 66 bytes captured (528 bits) on interface 0 Ethernet II, Src: Watchgua_LOCALMAC (AA:BB:CC:LOCALMAC), Dst: Hewlett-_SUB_MAC (11:22:33:SUB_MAC) Internet Protocol Version 4, Src: __REMOTE__IP__ (__REMOTE__IP__), Dst: _LOCAL_IP_ (_LOCAL_IP_) Transmission Control Protocol, Src Port: 4585 (4585), Dst Port: 54617 (54617), Seq: 0, Ack: 1, Len: 0 No. Time Source Destination Protocol Length Info 2623 11.459475000 _LOCAL_IP_ __REMOTE__IP__ TCP 54 54617 > 4585 [ACK] Seq=1 Ack=1 Win=4194304 Len=0 Frame 2623: 54 bytes on wire (432 bits), 54 bytes captured (432 bits) on interface 0 Ethernet II, Src: Hewlett-_SUB_MAC (11:22:33:SUB_MAC), Dst: Watchgua_LOCALMAC (AA:BB:CC:LOCALMAC) Internet Protocol Version 4, Src: _LOCAL_IP_ (_LOCAL_IP_), Dst: __REMOTE__IP__ (__REMOTE__IP__) Transmission Control Protocol, Src Port: 54617 (54617), Dst Port: 4585 (4585), Seq: 1, Ack: 1, Len: 0 No. Time Source Destination Protocol Length Info 2634 11.482207000 __REMOTE__IP__ _LOCAL_IP_ FTP 108 Response: 125 Data connection already open; Transfer starting. Frame 2634: 108 bytes on wire (864 bits), 108 bytes captured (864 bits) on interface 0 Ethernet II, Src: Watchgua_LOCALMAC (AA:BB:CC:LOCALMAC), Dst: Hewlett-_SUB_MAC (11:22:33:SUB_MAC) Internet Protocol Version 4, Src: __REMOTE__IP__ (__REMOTE__IP__), Dst: _LOCAL_IP_ (_LOCAL_IP_) Transmission Control Protocol, Src Port: ftp (21), Dst Port: 54613 (54613), Seq: 246, Ack: 80, Len: 54 File Transfer Protocol (FTP) No. Time Source Destination Protocol Length Info 2635 11.483996000 __REMOTE__IP__ _LOCAL_IP_ FTP-DATA 60 FTP Data: 4 bytes Frame 2635: 60 bytes on wire (480 bits), 60 bytes captured (480 bits) on interface 0 Ethernet II, Src: Watchgua_LOCALMAC (AA:BB:CC:LOCALMAC), Dst: Hewlett-_SUB_MAC (11:22:33:SUB_MAC) Internet Protocol Version 4, Src: __REMOTE__IP__ (__REMOTE__IP__), Dst: _LOCAL_IP_ (_LOCAL_IP_) Transmission Control Protocol, Src Port: 4585 (4585), Dst Port: 54617 (54617), Seq: 1, Ack: 1, Len: 4 FTP Data (test) No. Time Source Destination Protocol Length Info 2636 11.484173000 __REMOTE__IP__ _LOCAL_IP_ FTP 106 Response: 426 Data connection closed. Error scanning content Frame 2636: 106 bytes on wire (848 bits), 106 bytes captured (848 bits) on interface 0 Ethernet II, Src: Watchgua_LOCALMAC (AA:BB:CC:LOCALMAC), Dst: Hewlett-_SUB_MAC (11:22:33:SUB_MAC) Internet Protocol Version 4, Src: __REMOTE__IP__ (__REMOTE__IP__), Dst: _LOCAL_IP_ (_LOCAL_IP_) Transmission Control Protocol, Src Port: ftp (21), Dst Port: 54613 (54613), Seq: 300, Ack: 80, Len: 52 File Transfer Protocol (FTP)
啊 – 所以我们testing连接到FTP服务器，使用非标准的控制端口和文件传输正常工作。
只有当我们连接到使用21的标准控制端口的FTP服务器时，传输才有问题。
我们清除了防火墙的设置，重build并重置了防火墙上的设置。 这个问题是固定的。
应用的设置与之前的设置相同。 不知何故，防火墙上的设置已经损坏。 这就是她写的，真的。
响应：426数据连接已closures。 扫描内容时出错
它们之间肯定有一个防火墙拦截FTPstream量。 据我所知，Microsoft FTP不支持扫描内容。
要清楚的是：这是一个比防火墙更重要的 防火墙事情。
此外， 非标准端口的理论支持这一点。 （中环FW似乎只检查到21号港口）
把这个和你的networkingpipe理员一起。
那么基于“426数据连接closures。错误扫描内容”消息你正在得到。 这看起来像是一个networking防火墙扫描病毒。