"Stefan Sassenberg" <stefan.sassenberg_at_gmx.de> said:

> Thank your for your advice. The result is as follows. As I see it, the
> handshaking is done quite quickly (frames 43-64) but there are DNS
> queries and an ICMP package that I can't explain and that stop all the
> traffic for 1.5 seconds. This is repeated three times before the next
> ftp command is sent (frame 56). Those DNS queries start in frame 47.
> Strange.

Not so strange because libcurl is calling gethostbyaddr() in
ftp_pasv_verbose(). Turn off verbose-mode CURLOPT_VERBOSE) and it
shouldn't do that.

BTW. Shouldn't Ares be used to do that in parallell?

> ----------------------------- Frame ID: 47 -----------------------------
> Frame arrived at 11/21 13:08:29.428574, Frame Status: (Good Frame)
> 0050FCA3F258 --> 00B0648A8B31
> 12.0.0.1 --> 194.95.172.11
> Ev2 ET=0x0800:
> IP PRO=UDP ID=20554 LEN=78:
> UDP SP=137 DP=137 LEN=58:
> DNS C ID=36227 OP=Query QN=*:
>
> ----------------------------- Frame ID: 48 -----------------------------
> Frame arrived at 11/21 13:08:29.428654, Frame Status: (Good Frame)
> 0050FCA3F258 --> 00B0648A8B31
> 11.11.0.2 --> 194.95.172.11
> Ev2 ET=0x0800:
> IP PRO=UDP ID=20555 LEN=78:
> UDP SP=137 DP=137 LEN=58:
> DNS C ID=36229 OP=Query QN=*:

Why 2 domain requests from different IPs? Is your box multihomed?

> ----------------------------- Frame ID: 49 -----------------------------
> Frame arrived at 11/21 13:08:29.432403, Frame Status: (Good Frame)
> 00B0648A8B31 --> 0050FCA3F258
> 141.16.81.70 --> 12.0.0.1
> Ev2 ET=0x0800:
> IP PRO=ICMP ID=41540 LEN=56:
> ICMP Communication Administratively Prohibitated by Filtering:
>
> ----------------------------- Frame ID: 50 -----------------------------
> Frame arrived at 11/21 13:08:30.927941, Frame Status: (Good Frame)
> 0050FCA3F258 --> 00B0648A8B31
> 12.0.0.1 --> 194.95.172.11
> Ev2 ET=0x0800:
> IP PRO=UDP ID=20556 LEN=78:
> UDP SP=137 DP=137 LEN=58:
> DNS C ID=36231 OP=Query QN=*:

You box doesn't care about the "ICMP host/port unreachable" message and
retransmit the query. Hence the long delay.
Looks like your DNS setup is wrong.

--gv

-------------------------------------------------------
This SF.net email is sponsored by: SF.net Giveback Program.
Does SourceForge.net help you be more productive? Does it
help you create better code? SHARE THE LOVE, and help us help
YOU! Click Here: http://sourceforge.net/donate/
Received on 2003-11-21