Topic "FTP Transfer Slow - Seeing tcp ports 5001 & 5011"

Author Message
[View user's profile]

Joined: 2011-09-29
Posts: 1
Location: Miami Valley
Using 4.3.5 on Win 2008 Server R2. File transfers are unusually slow. With Wireshark sniffer we see packets using tcp ports 5001 and 5011 in-between the ftp-data packets on the wire. In the past these were associated with a trojan or backdoor. We have a vendor that set this up - could use of these port numnbers be customized port numbers? Or something we should be concerned about?

5001 [commplex-link] Back Door Setup, Sockets des Troie
5011 [telelpathattack] One of the Last Trojans - OOTLT, One of the Last Trojans - OOTLT, modified

On a gig link each 3000 byte chunk of data takes about 45ms to transfer where 5001 and 5011 are doing ACKS between chunks.
[View user's profile]
Site Admin
Joined: 2002-12-10
Posts: 26890
Location: Prague, Czechia
It this passive or active FTP mode?
Martin Prikryl

You can post new topics in this forum


What is WinSCP?

It is award-winning SFTP client, SCP client, FTPS client and FTP client integrated into one software program for file transfer to FTP server or secure SFTP server. [More]

And it's free!


About donations

$9   $19   $49   $99

About donations


WinSCP Privacy Policy

WinSCP License