Destination Port: 21, it’s a port number associated with ftp service.It’s a number that lies anywhere above 1023. Source Port: 43854, it’s the TCP host that initiated a connection.The explanation for each field in the Transport Control Protocol layer in Wireshark is given below: You can notice that the first TCP datagram for the ftp session initiation only sets SYN bit to 1. We highlight the TCP packet from the host computer to the ftp McAfee server to study the Transfer Control Protocol layer in the Packet detail panel. Wireshark displays detailed TCP information that matches the TCP packet segment. Apply tcp filter to see the first three packets in the Packet list panel. Use Ctrl+C to stop the capture and look for the FTP session initiation, followed by the tcp, , and packets illustrating a three-way handshake for a reliable session. Log-in with your credentials, as shown in the screenshot below. Start packet capture from your selected interface and use the ftp command in the terminal to access the site. Hence, we will begin our analysis with the available TCP packet information for the FTP session initiation and termination in the middle pane. For every datagram exchange, TCP initiates a new session between the FTP client and the FTP server. TCP is generally used in every session to control datagram delivery, arrival, and window size management.

The FTP client and server communicate while being unaware that TCP manages every session. Later a separate data connection is established to transfer files and folders. Such servers are known as anonymous FTP servers. But some servers make all of their content available without any credentials. A control connection requires a login to establish a connection. The FTP client first builds a control connection request to the server port 21. As HTTP is built for Websites, FTP is optimized for large file transfers between computers. Simply put, it’s a way to share files between connected computers. FTPįTP is a protocol used by computers to share information over the network. Before we dig deep into the captured packet analysis, we will begin with a brief understanding of the protocol. In this article, we will learn how FTP works and examine FTP Wireshark captures. The previous article has provided you with an in-depth understanding of the Wireshark filters, OSI layers, ICMP, and HTTP packet analysis.

Wireshark http get capture filter