IIS FTP Service Hang Due to Ports Contention in Passive-Mode


IIS FTP is a stable and comparable simple service running in Inetinfo.exe. We seldom face performance issues regarding FTP itself, most of them are caused by network connection or system wide performance issue. Here is one interesting FTP performance case that is related to  FTP working mode and system ports resource.




FTP service hangs intermittently. When customer uses the FTP client to connect the IIS FTP, cannot get response.




Checked the Performance data, there is no system non-paged pool or Free Page Table Entries exhausting issue.


Here is the basic data about nonpage pool size when you enable /3GB or not:

Win2003/Win2000 32bit:           Nonpaged pool memory 256MB (128MB if /3GB is specified)
Windows 2003 64 Bit:                  NonPaged pool memory 128GB (or 131,072MB)


This is the some information about Free PTE and how to check it:


316739  How to use the /userva switch with the /3GB switch to tune the User-mode space to a value between 2 GB and 3 GB



We also captured several memory dump files while problem happens, the memory dump shows most FTP threads waiting on Ports operation. Compared several dump files, FTP does not real hang, tends to be slowness:


0:026> kb

ChildEBP RetAddr  Args to Child             

0492f978 7c966fcb 719d288a 0000132c 00000c7c ntdll!KiFastSystemCallRet 

0492f97c 719d288a 0000132c 00000c7c 00000000 ntdll!ZwDeviceIoControlFile+0xc 

0492fad8 719d461b 0252d3f0 007f1f20 00000000 mswsock!SockSetHandleContext+0x1cd 

0492fb3c 71ab3fd5 00000002 00000001 00000006 mswsock!WSPSocket+0x13f 

0492fb9c 6962ec7a 00000002 00000001 00000006 ws2_32!WSASocketW+0xce 

0492fbf0 6962ae3a 0492fc0c 66c9c80a 00dd08f8 ftpsvc2!CreateFtpdSocket+0x34 

0492fc24 69636c5f 00dfd9b0 00000000 00000000 ftpsvc2!MainPASV+0x36


The client is using PASV mode to connect the FTP at that time:


0:026> .frame 16

16 0492fc4c 69632af2 ftpsvc2!ParseCommand+0x222

0:026> dv

 pszCommandText = 0x0492fc70 "PASV"



Now we suspect it is related networking issue because working threads pending on winsock modules. Use “netstat -ano", noticed that many ports under 5000 are occupied by a different service process 1511:



  TCP    ESTABLISHED     1511

  TCP    ESTABLISHED     1511

  TCP    ESTABLISHED     1511

  TCP    ESTABLISHED     1511

  TCP    ESTABLISHED     1511


As we know, passive mode FTP clients start by establishing a connection to TCP port 21 on the FTP server to create the control channel. When the client sends a PASV command over the command channel, the FTP server opens an ephemeral port (between 1024 and 5000) and informs the FTP client to connect to that port before requesting data transfer. As in Standard mode, the FTP client must send a new PASV command prior to each new transfer, and the FTP server will await a connection at a new port for each transfer.


If the ports from 1024 and 5000 are few or not available, we will experience the FTP performance issue.




To resolve the problem, we can choose FTP Active mode (FTP PORT mode),  or shift the ports consumer process to a different machine. Customer chose to remove the special process out of the box, problem was resolved.


More information about FTP working mode


283679  Information About the IIS File Transmission Protocol (FTP) Service





Freist Li

Skip to main content