DEMO: FTP, Wireshark

We're going to take a look at the FTP traffic that goes across between our demo laptop and our demo Pi using Wireshark.

Capturing the traffic

The first thing that I'm going to do is I'm going to open up Wireshark. I'm on my demo laptop. I'm going to open up Wireshark and we're going to monitor this Ethernet connection. So now I'm monitoring that Ethernet connection.

I'm going to open up my file server, FileZilla. That's my FTP client software that's going to connect to the FTP server. And so I'm going to connect to my demo Pi. The username is demo pi and the password is demo pi. I'm going to do a quick connect. It's going to warn me I'm connecting with clear text, so my password will go across clear text. I'm going to say that's okay, let's do this. And then it's going to make a connection and show the directory.

So I'm going to click on the directory files. Within there we've got this test file that we created in a last video, or in a couple videos ago. And I'm going to copy it over to my computer just so we can generate some traffic with that and we can see what that traffic looks like. So once it's done with that, I actually get a message that says it's finished. What I'm going to do is disconnect from this server now, so I'm going to disconnect. And we see some stuff happening on our Wireshark. We're going to take a look at Wireshark and what that looks like. I'll close out of FileZilla and then we will stop capturing on our Wireshark.

Filtering and reading the login

Now on Wireshark, we've captured 179 packets. So I just want to look at this FTP traffic. What I'm going to do is I'm going to filter based off of our IP address 10.1.0.3, just so we just see the traffic that's going back and forth between these two devices.

The first thing that I'm going to do is I'm going to scroll through here, and you can see a couple requests come for a username and password. And so then let's take a look at what the return is. The first thing that we'll look at is this packet 42 here. It is sending the information that the demo Pi requested, which is the username and password. So this 42 is coming from the demo laptop and going to the demo Pi, and it says that the user is demo pi. And then we see a couple lines down and it's saying the password is demo pi also. So the thing I want to point out here is that this demo pi is listed in clear text. So that's showing you that this is insecure in our current setup while we're using FTP. We see then the demo Pi does respond with login successful, so it has a login successful that it returns back.

Commands and the second connection

As we scroll through these, we can see we get a little further down, there's a request that is coming from the demo laptop and going to the demo Pi, and it is giving the command pwd, which means present working directory. It's the same thing that you would type in with a Linux command. And we see that the response is the directory is slash, or root. We call that root. So it returns that back and it has the current working directory.

And then it goes through and asks, a little bit further on here, to list. It requests a list of what's inside this directory. And then we see what it does is it establishes a second connection with this. So it's opening up a second TCP connection with this on a different port. So it opens that up, and then we see actual data that gets sent back and forth. And if we look at the data that's sent back and forth, we see down here inside the packet it's actually giving some information on the directory, that that is also in here, which is files. So there is a directory called files within the root directory that we're in, listed as files, and it's sending that information back.

So a couple things I want to point out with this is it is an FTP-data connection that they have established. It's a separate connection, so it's established the second connection to make this communication happen. The other thing that we notice is the port it's using. If we look at the port here, it's going from the demo Pi, so the source port here is 63,635. And so the source port is this very large number, so we're seeing that this data is being transferred on a separate port.

And what we have already said in one of our prior videos is that data will be transferred on port 21, but it doesn't have to be port 21. It depends on the type of traffic. In fact, sometimes it'll be port 20, sometimes it'll be port 21. In this case, it's port 63,635. So it will vary a little bit, but traditionally that gets sent on port 20, the data on port 20, and then the rest of this is happening on port 21. All that communication, all that control data is happening on the port 21.

Changing directories and transferring the file

So then we look further down, it's now got this directory of files in here. If we look a little further, we see a change working directory. So it changes working directory. The request is to a change working directory /files, and the demo Pi responds with it's been successful. And then there's a request for the present working directory, and the response is present working directory is /files. So you see this communication that's going back and forth: when you execute a command, then it will send that command and then it will return information.

And then we see a list right here. It's listing out now the files that we got. And if you recall, what was inside of the files was a text document. So let's take a look and see what that text document is. It establishes yet another TCP connection, and then it does the data transfer here. And it is saying there is, like we just mentioned, a test.txt that's within there. So it establishes this TCP connection, it transfers the data, and then it terminates that TCP connection. It is using a different port than what we saw earlier: this port uses 14,575.

So then we go through here and we see a request for the test.txt, and then we see now yet another, it establishes yet a different TCP connection with a different port here. Let's see, as we go down I want to actually do that data transfer. So here we go, here's the FTP data transfer that happens. We see right before it, it establishes this 19,455 port. We see then the data actually gets sent across. If we were to actually look in the data down here, this is a test. So if I were to open up what is inside that file, it in fact says this is a test. So we can actually read the contents of that file that was transferred over, and then it terminates that communication, that TCP connection that it did.

Control and data connections

So we see that once again all of that control data is happening on the port 21. But then when we go to execute some of these data transfers, what will happen is it will establish a second connection and transfer on that second connection, whether that second connection happens on port 20 as we mentioned before, or it could happen on one of some of these other ports, choosing a random ephemeral port. And there are sometimes where data will go across 21. For the purposes of most tests that you'll see, just consider that it's using port 21 and 20, but as we see, in reality it can use other ones depending on the type of data that's being transferred.