is it possible to build a capture filter to capture FTP traffic using non-standard TCP port 20 or 21? asked 02 Mar '12, 23:26  wsitu |
One Answer:
If you are using Active FTP, you can use the alternative TCP ports for the command and the data channel to build a capture filter. If you use 10021 for the command channel and 10020 for the data channel, you can use the capture filter If you are using passive FTP, then you can only filter on the command channel, as the data channel uses ephemeral ports for which you would have to do deep inspection of the FTP traffic to extract the port numbers. answered 03 Mar '12, 08:26  SYN-bit ♦♦ |
