FTP is a chatty protocol, but each message contains very little information.
It's like text messaging your friends many messages with a few words each time.
As a result, Wireshark can print most relevant data in the Info column,
often obviating the need for packet digging.
First,
the client with IP address 10.1 .4 .4 sends a TCP SYN to start the 3-way
handshake with the server at IP address 10.2 .5 .5.
The server responds with a TCP SYN ACK,
and the client completes the transaction with a TCP ACK.
This is basic TCP communications,
and I won't be discussing it much in this FTP-specific course.
Notice the destination port of 21 used for FTP control communications.
After the TCP session is established, the server sends a 220 message,
indicating it is ready for a new user to log in.
It also includes its version information so the client knows
to what kind of server it is communicating.
The FEAT command is an extension to FTP standardized in RFC 2389.
For those who viewed my Ansible course on network management,
I discussed NETCONF and the initial capabilities exchange.
The FEAT command is comparable,
as it allows the client to ask the server what features do you support.
The server responds with individual features,
such as passive mode, last modified time,
file size query, and many more.
This helps the client best utilize the available server capabilities.
Now that the client and server have gotten to know each other,
it's time to log in.
This process is long, but simple to understand.
The client sends the AUTH message to initiate this process,
preferring to use TLS, which isn't available yet.
Don't worry, we cover this later.
The server responds with a 530 message, asking for credentials.
Memorizing all these codes is unimportant, so again, don't stress.
The client sends the USER command along with the associated username,
which is ftpuser.
The server responds with a 331 message, indicating that the username was okay,
and asking for the password.
The client honors this request and sends its password using the
PASS command and plain text string of ftppass.
The server sends back message 230 to indicate a successful login.
Pretty basic exchange.
Some FTP clients will send some additional commands immediately after login.
The first is print working directory, or PWD.
This triggers a 257 message from the server,
carrying back a string of the current directory.
The client changes the type to I.
The two most common types of transport include A and I.
A stands for ASCII and is used for text files or server output,
such as the output from the list command.
I stands for image, really meaning binary data,
such as pictures, music, and videos.
Most clients use binary any time a get or put operation takes place,
even if the file in question is plain text.
Clients will switch to ASCII automatically when
text-based interactive commands are used.
We will see this soon.
I'll cover the next two commands together since they are very basic.
The SIZE command returns the size of the file in bytes, which is 38.
The MDTM command returns the last modified time and date.
The server provides this information without issue.
From the Wireshark summary,
we see the client uses the PORT command and has a
comma-delimited argument string.
What is this information trying to convey?
I'll cover this on the next slide because it's
worth digging deep into the packet.
Just know that this is the client telling the server,
I want you to open a session to me on some random port.
The server is perfectly fine with this request and uses a 200 message to say so.
Similar to HTTP, 200 means OK in FTP,
and it's a message we will see many times in this course.
Most FTP servers suggest using passive mode with the PASV command,
but that's covered in the next module.
The client issues the RETR command, which stands for retrieve.
When we type get at the FTP shell, that means retrieve.
The file name of R1.cfg is supplied, which is the file to download.
Before exploring the port command,
let me draw your attention to the source and destination TCP ports.
This whole time the client has sent traffic to the server on
port 21 from a high-numbered random port.
Basic TCP chatter, right? That will change soon.