# Revision history [back]

### How are FTP ports decided ?

So i have a pcap log file which has FTP transfer. There is a RETR in the file which denotes Download from the FTP server and which is on stream 3 and is going on client port 49210 and server port 21 . Then i see after all the setup SYN / SYN ACK is complete the actual data transfer starts on different ports client - 49211 and server 64525.

How does the client know which server port to sent the data too.. are the port id's negotiated somewher ? also the stream on which the actual data transfer happenss is different. .

448 0.000 16:22:31.591 10.339 10.126.7.181 52.52.210.193 FTP 57 78 214 95 17 65535 328505 Request: RETR 5000MB.txt 09:22:31.591 3 49210 21

450 0.000 16:22:31.599 10.348 10.126.7.181 52.52.210.193 FTP-DATA 1410 267527 1 268885 80122 131712 329967 FTP Data: 1358 bytes 09:22:31.599 4 49211 64525

 2 None grahamb 23476 ●4 ●806 ●226 https://www.wireshark.org

### How are FTP ports decided ?

So i have a pcap log file which has FTP transfer. There is a RETR in the file which denotes Download from the FTP server and which is on stream 3 and is going on client port 49210 and server port 21 . Then i see after all the setup SYN / SYN ACK is complete the actual data transfer starts on different ports client - 49211 and server 64525.

How does the client know which server port to sent the data too.. are the port id's negotiated somewher ? also the stream on which the actual data transfer happenss is different. .

448 0.000   16:22:31.591    10.339  10.126.7.181    52.52.210.193   FTP 57  78  214 95  17  65535   328505      Request: RETR 5000MB.txt    09:22:31.591    3   49210   21 21
450 0.000   16:22:31.599    10.348  10.126.7.181    52.52.210.193   FTP-DATA    1410    267527  1   268885  80122   131712  329967      FTP Data: 1358 bytes    09:22:31.599    4   49211   6452564525