Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to analyze ftp traffic in Wireshark. I can see commands like Request: List, PORT. But after FTP

Response 150: Opening data channel for directory list.

what I see immediately is

Response 226: Transfer OK

where is a list of files? Why I don't see it? (I've got this list - I can see it in terminal)

share|improve this question

You're following a single TCP connection. FTP data transfers occur over a second connection. Stop following the connection (or filtering) and you should see the data transfer, assuming you didn't use capture filters and actually captured it.

share|improve this answer
I tried this way but cannot find it. What filters might help? I tried by port 21 and second port of connection – user107788 Jul 7 '13 at 22:10
As I already said, you'll miss it if you filter by port 21. Try not filtering at all, or filtering by IP address. – Michael Hampton Jul 7 '13 at 22:11
I ve found, forget that data comes from port 20. One question: this stream comes to also different port on ftp client but I cannot find where client passed this info to FTP server. Is this that number passed with Port request? – user107788 Jul 7 '13 at 22:27
It sounds like you need to go read how the protocol works. – Michael Hampton Jul 7 '13 at 22:31
It might be more complicated in this case because it goes from my machine through TP-Link to my server and back. In FTP-Data frame I see TP-Link as source, not server which is behind TP-Link – user107788 Jul 7 '13 at 23:34

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.