Vulnerability Development: PORT or PASV mode of IIS 4.0's FTP

["C. K. Lung" <clung () HOTMAIL COM>]

What is the "mode" of a FTP server running on MS IIS 4.0 w/sp6a?  Is it "normal/standard", "passive" or both?  Can it 
be configured by the administrator?

How about the ftp client comes Solaris?  Is "normal", passive or both?

The ftp client is trying to "get" 15,000 1-K files from the IIS's FTP server, the connection is killed by FW-1 after it 
got 100 files.  The fw-log shows that when the client's "source port" hit a "pre-defined service (port) in the 
rulebase, the connection is dropped.  CP explained that FW-1 thought that it was a security violation.

Talked to many people at work, no-one could offer any explanation.

Any pointers are appreciated.

Thanks,

CLUNG