The FTP PORT command is quite interesting.
From the Wireshark summary,
we see the packet uses the PORT command and has a
comma-separated argument string.
What is this information trying to convey?
Let's check the packet details at the bottom.
Wireshark graciously decodes this for us.
Each value in the comma-separated list is 1 byte,
and is therefore a value between 0 and 255 inclusive.
The first 4 bytes represent the client's IPv4 address of 10.1 .4 .4,
which is rather easy to see.
What about the last 2 bytes?
Remember that TCP port numbers are 2 bytes long.
The first number needs to be multiplied by 256 to account for the fact that it
represents the high-order 8 bits of the TCP port number.
The second number just needs to be added to the product.
The high-order 8 bits are 180 and 180 times 256 is 46080.
Then add 117, and you get 46197.
This is how Wireshark computes the dynamic port number behind the scenes.
Let's pick up where we left off.
Just before this screenshot, the client sent the retrieve command to the server.
In response,
the server sends a TCP SYN to initiate a new TCP session
sourced from port 20 and destined to the active mode port
we saw in the previous slide.
The client told the server, hey, I'm listening on port 46197,
so you should open a session to me on that port when we transfer files.
Once the new TCP session is completely negotiated,
the server sends back a 150 message in the FTP signaling
channel to indicate the stream is ready.
Immediately thereafter,
the server transfers the file contents as plain text data
using the newly built TCP data channel.
Tiny files can fit into a single packet,
but larger files will require multiple packets.
The combination of TCP chatter and the final completion message from
the FTP server indicates the transfer succeeded.
I'm showing the contents of the FTP data on the wire,
which shows a few lines of bogus text from the transferred file.
What makes FTP more than just a file transfer protocol is the rich set
of directory management features that it supports.
This isn't the focus of the course,
but you should be aware of these capabilities.
When we run the ls command to list the directory contents,
this triggers a flurry of FTP chatter.
The transfer type changes from binary to ASCII since FTP can
transport the text output from the shell command.
This triggers a new port command to build a new FTP data session
using a new dynamic port allocated by the client.
Every new FTP exchange requires a dedicated data channel.
This time, the port selected is 32963.
The server notifies the client that the directory listing is on its way.
Digging into the FTP data packets seen on the network,
we see it's just plain text shell output.
It's the same thing as typing ls on the remote machine, revealing basic data, such as file permissions and file names.