viewing data transfer on ftp port 21
David G. Miller
dave at davenjudy.org
Tue Nov 28 15:36:17 UTC 2006
Ed Greshko <Ed.Greshko at greshko.com> wrote:
> thomas wrote:
>> > There is requirement to view the data transfer being done by any user
>> > or application on port no 21 (i.e ftp port). Is there any option in
>> > netstat that can show data is being transfered on port no 21 or data
>> > transfer has been completed?
>> > Any other way to track the same?
> You will need to record activity on ports 20 and 21. Port 20 is the "data
> channel" for ftp while port 21 is the "command channel".
Unless the user sets passive mode. Then both data and commands are on
You can use something like tcpdump to grab the content and commands.
Unfortunately, matching up the transfered data with the command session
is non-trivial. tcpreplay allows you to "replay" a captured session if
that's any help.
Politics, n. Strife of interests masquerading as a contest of principles.
-- Ambrose Bierce
More information about the users