In Wireshark traces, I can find a packet which has both 150 and 226 FTP codes. The server is programmed to handle 150 and 226 codes in different packets: the former followed by latter. If both codes are found in a single packet, the server gets confused and skips the data transfer.
The packet flow is:
Is this expected behavior? If yes, under what scenario?
Per RFC 959, "File Transfer Protocol (FTP)", 150 means "File status okay; about to open data connection" and 226 means "Closing data connection." There should be a data transfer in between these two commands, so it would certainly be unusual to have both commands in the same packet. Still, there is nothing in the RFC that forbids it, so I suppose both commands could appear in the same packet if the file being transferred is extremely small or the server for some reason decides to immediately close the data connection. The RFC does require each reply code to be on a separate line.
You say the server gets confused and skips the data transfer if both codes are found in a single packet. The server doesn't get confused by these codes; the server is the one sending these codes. The server is not skipping the data transfer because there's both a 150 and a 226 code in the same packet. Rather, there are both a 150 and a 226 code in the same packet because the server has skipped the data transfer.
Sounds like your server is misbehaving. The presence of both codes in the same packet is not the cause of the problem, it's a symptom of the problem.
answered 06 Jul '12, 08:34