How are FTP ports decided ?

FTP
RETR
Port
retag add tags

So i have a pcap log file which has FTP transfer. There is a RETR in the file which denotes Download from the FTP server and which is on stream 3 and is going on client port 49210 and server port 21 . Then i see after all the setup SYN / SYN ACK is complete the actual data transfer starts on different ports client - 49211 and server 64525.

How does the client know which server port to sent the data too.. are the port id's negotiated somewher ? also the stream on which the actual data transfer happenss is different. .

448 0.000   16:22:31.591    10.339  10.126.7.181    52.52.210.193   FTP 57  78  214 95  17  65535   328505      Request: RETR 5000MB.txt    09:22:31.591    3   49210   21
450 0.000   16:22:31.599    10.348  10.126.7.181    52.52.210.193   FTP-DATA    1410    267527  1   268885  80122   131712  329967      FTP Data: 1358 bytes    09:22:31.599    4   49211   64525

achillez16

asked 2018-02-19 02:36:34 +0000

23.8k

grahamb

updated 2018-02-19 11:07:52 +0000

edit flag offensive 0 remove flag close merge delete

Comments

add a comment see more comments

Yes, the ports are negotiated, or more accurately, announced. FTP can be Active Mode or Passive Mode. In the command channel, which is on port 21, look for PORT or PASV commands.

In an Active Mode connection, the client issues the PORT command and tells the server what IP address and port it will be listening on for the data connection. The server then connects to the client.

In a Passive Mode connection, the client issues the PASV command. The server then tells the client what IP address and port it will be listening on for the data connection, and the client connects to the server.

7.5k

Jim Aragon

answered 2018-02-19 04:35:32 +0000

edit flag offensive 0 remove flag delete link

Comments

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

How are FTP ports decided ? edit

Comments

1 Answer

Comments