Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am trying to analyze ftp traffic in Wireshark. I can see commands like Request: List, PORT. But after FTP

Response 150: Opening data channel for directory list.

what I see immediately is

Response 226: Transfer OK

where is a list of files? Why I don't see it? (I've got this list - I can see it in terminal)

share|improve this question

1 Answer 1

You're following a single TCP connection. FTP data transfers occur over a second connection. Stop following the connection (or filtering) and you should see the data transfer, assuming you didn't use capture filters and actually captured it.

share|improve this answer
I tried this way but cannot find it. What filters might help? I tried by port 21 and second port of connection – tinky_winky Jul 7 '13 at 22:10
As I already said, you'll miss it if you filter by port 21. Try not filtering at all, or filtering by IP address. – Michael Hampton Jul 7 '13 at 22:11
I ve found, forget that data comes from port 20. One question: this stream comes to also different port on ftp client but I cannot find where client passed this info to FTP server. Is this that number passed with Port request? – tinky_winky Jul 7 '13 at 22:27
It sounds like you need to go read how the protocol works. – Michael Hampton Jul 7 '13 at 22:31
It might be more complicated in this case because it goes from my machine through TP-Link to my server and back. In FTP-Data frame I see TP-Link as source, not server which is behind TP-Link – tinky_winky Jul 7 '13 at 23:34

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.