I am trying to analyze ftp traffic in Wireshark. I can see commands like Request: List, PORT. But after FTP

Response 150: Opening data channel for directory list.

what I see immediately is

Response 226: Transfer OK

where is a list of files? Why I don't see it? (I've got this list - I can see it in terminal)


You're following a single TCP connection. FTP data transfers occur over a second connection. Stop following the connection (or filtering) and you should see the data transfer, assuming you didn't use capture filters and actually captured it.

  • I tried this way but cannot find it. What filters might help? I tried by port 21 and second port of connection – user107788 Jul 7 '13 at 22:10
  • As I already said, you'll miss it if you filter by port 21. Try not filtering at all, or filtering by IP address. – Michael Hampton Jul 7 '13 at 22:11
  • I ve found, forget that data comes from port 20. One question: this stream comes to also different port on ftp client but I cannot find where client passed this info to FTP server. Is this that number passed with Port request? – user107788 Jul 7 '13 at 22:27
  • 1
    It sounds like you need to go read how the protocol works. – Michael Hampton Jul 7 '13 at 22:31
  • It might be more complicated in this case because it goes from my machine through TP-Link to my server and back. In FTP-Data frame I see TP-Link as source, not server which is behind TP-Link – user107788 Jul 7 '13 at 23:34

In wireshark, use the display filters as -

ftp || ftp-data

This should allow you to see both, the file listing and the commands. Make sure you don't have any capture filters.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy