Wireshark-users: Re: [Wireshark-users] How do I identify SSL secured FTP session?
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Stephen Fisher <steve@xxxxxxxxxxxxxxxxxx>
Date: Sat, 12 Feb 2011 23:55:13 -0700
On Sat, Feb 12, 2011 at 03:43:34PM -0600, David Alanis wrote:

> I forgot the most important part of your question. Once you have the 
> Wireshark capture and if you simply apply the view filter 'ftp' and 
> displays your entire connection. Then you know your FTP session is not 
> encrypted, hence ftp displays communication over port 21 and maybe 20?
> 
> I didn't see FTP listed under preferences > protocols.

The FTP dissector is hard-coded to handle two types of FTP traffic: FTP 
commands on port 21 and FTPDATA on port 20.  You should be able to right 
click on a packet and do "Decode as..." FTP also though.