So i have a pcap log file which has FTP transfer. There is a RETR in the file which denotes Download from the FTP server and which is on stream 3 and is going on client port 49210 and server port 21 . Then i see after all the setup SYN / SYN ACK is complete the actual data transfer starts on different ports client - 49211 and server 64525.
How does the client know which server port to sent the data too.. are the port id's negotiated somewher ? also the stream on which the actual data transfer happenss is different. .
448 0.000 16:22:31.591 10.339 10.126.7.181 52.52.210.193 FTP 57 78 214 95 17 65535 328505 Request: RETR 5000MB.txt 09:22:31.591 3 49210 21
450 0.000 16:22:31.599 10.348 10.126.7.181 52.52.210.193 FTP-DATA 1410 267527 1 268885 80122 131712 329967 FTP Data: 1358 bytes 09:22:31.599 4 49211 64525
