I have a Wireshark capture where it shows that the port was opened, the password was entered the data connection was established, the transfer was complete and the response was closed.
It looks as though the transfer of the text file went from pointA to pointB, but is there a way to see what was in that text file?
is there a way to see what was in that text file?
You could select a packet from the FTP data connection and do Analyze > Follow > TCP Stream, which should pop up a window containing all the text that was transferred.
I think a nicer long-term solution would be for Wireshark to be able to support the ability to export objects from ftp transfers. If that's a feature of interest, then I'd advise @baldchicken to open a Wireshark enhancement bug report for this at https://bugs.wireshark.org/bugzilla/.
Appreciate the input. Seems like an "enhancement request" is in order.
When I follow the steps to follow the TCP stream, it just shows a cleaner version of the packets:
230 User logged in.
PASV
227 Entering Passive Mode (10,2,2,156,237,255).
XYZ.txt
150 Opening ASCII mode data connection.
226 Transfer complete.
QUIT
221 Goodbye.
You selected a packet from the FTP control connection, not from the data connection, and did Follow > TCP Stream, so you got the text on the control connection.
FTP sends commands and responses over one TCP connection and file data over a separate TCP connection.
Asked: 2019-09-05 18:46:18 +0000
Seen: 21,414 times
Last updated: Sep 06 '19
What protocol was used to transfer the file?
Port 21 = FTP.... unencrypted traffic.