problem with passive ports and Firewall

I got a complaint from a customer of ours who is trying to ftp us data but
would get timeouts when doing transfers to us. I was finally able to
reproduce the problem and it appears it happens when two succesive file
transfers use the same passive port.

I'm trying to figure out why it is getting the same passive port multiple
times in a row.  I assume that it has to do with the speed (it only happens
with small transfers) or it is losing a close packet somewhere.

The timeout is cause because our firewall which is keeping track of the
session. I'm guessing it closes the dynamic rule when it sees the passive
port close...but since another one has opened up, it ends up blocking the
second transfer (I can see the blocks in the FW logs)

the FTP server is running
wu-ftpd 2.6.2
I've tried the versions from sunfreeware and built the latest version of
wu-ftpd myself and ran on Solaris 6 and 7.  All of them have this problem.
I tried doing it on a linux machine, but cannot seem to get it to repeat
since the transfer speeds are much slower(a whole different issue)

Active mode is not an option and I would prefer a solution where I didn't
have to open up a bunch of ports on the firewall.  I know I could limit the
rang of passive ports and the open up those ports on our firewall, but  I
would prefer to leave the firewall alone.

any sggestions?  is this a bug?

Jim Michaud

Here is the log of the FTP session
ftp> mput *
local: CHANGES.TXT remote: CHANGES.TXT
227 Entering Passive Mode (X,X,X,X,238,246)
150 Opening BINARY mode data connection for CHANGES.TXT.
226 Transfer complete.
103884 bytes sent in 0.0168 secs (6e+03 Kbytes/sec)
local: CHANGES.TXT.1 remote: CHANGES.TXT.1
227 Entering Passive Mode (X,X,X,X,238,246)
ftp: connect: Connection timed out
local: CHANGES.TXT.10 remote: CHANGES.TXT.10
227 Entering Passive Mode (X,X,X,X,17,75)
150 Opening BINARY mode data connection for CHANGES.TXT.10.
226 Transfer complete.
103884 bytes sent in 0.349 secs (2.9e+02 Kbytes/sec)
local: CHANGES.TXT.2 remote: CHANGES.TXT.2
227 Entering Passive Mode (X,X,X,X,146,203)
150 Opening BINARY mode data connection for CHANGES.TXT.2.
226 Transfer complete.
103884 bytes sent in 0.234 secs (4.3e+02 Kbytes/sec)
local: CHANGES.TXT.3 remote: CHANGES.TXT.3
227 Entering Passive Mode (X,X,X,X,146,203)
.
.
.