viewing data transfer on ftp port 21

[Jim Cox]

> > thomas wrote:
> > There is requirement to view the data transfer being done by any user
> > or application on port no 21 (i.e ftp port). Is there any option in
> > netstat that can show data is being transfered on port no 21 or data
> > transfer has been completed?
> > Any other way to track the same?
>
> You will need to record activity on ports 20 and 21.  Port 20 is the "data
> channel" for ftp while port 21 is the "command channel".

Doesn't passive FTP complicate things a bit?
  http://slacksite.com/other/ftp.html

In addition to tcpdump & ethereal, strace on the FTP server is another
possibility.