下面是一个用wireshark抓的 ， ftp open时候的过程。
客户端和服务器端的端口都没有变化，服务器用的是21端口 。
1. 三次握手
No. Time Source Destination Protocol Info 1 0.000000 10.74.52.92 10.77.21.166 TCP 34756 > ftp [SYN] Seq=0 Win=5840 Len=0 MSS=1460 SACK_PERM=1 TSV=555948430 TSER=0 WS=7 Frame 1: 74 bytes on wire (592 bits), 74 bytes captured (592 bits) Ethernet II, Src: Tp-LinkT_2c:b6:ef (00:19:e0:2c:b6:ef), Dst: Cisco_52:62:08 (00:19:55:52:62:08) Internet Protocol, Src: 10.74.52.92 (10.74.52.92), Dst: 10.77.21.166 (10.77.21.166) Transmission Control Protocol, Src Port: 34756 (34756), Dst Port: ftp (21), Seq: 0, Len: 0 No. Time Source Destination Protocol Info 2 0.105200 10.77.21.166 10.74.52.92 TCP ftp > 34756 [SYN, ACK] Seq=0 Ack=1 Win=64512 Len=0 MSS=1330 WS=0 TSV=0 TSER=0 SACK_PERM=1 Frame 2: 78 bytes on wire (624 bits), 78 bytes captured (624 bits) Ethernet II, Src: Cisco_2c:6a:80 (00:18:74:2c:6a:80), Dst: Tp-LinkT_2c:b6:ef (00:19:e0:2c:b6:ef) Internet Protocol, Src: 10.77.21.166 (10.77.21.166), Dst: 10.74.52.92 (10.74.52.92) Transmission Control Protocol, Src Port: ftp (21), Dst Port: 34756 (34756), Seq: 0, Ack: 1, Len: 0 No. Time Source Destination Protocol Info 3 0.105244 10.74.52.92 10.77.21.166 TCP 34756 > ftp [ACK] Seq=1 Ack=1 Win=5888 Len=0 TSV=555948456 TSER=0 Frame 3: 66 bytes on wire (528 bits), 66 bytes captured (528 bits) Ethernet II, Src: Tp-LinkT_2c:b6:ef (00:19:e0:2c:b6:ef), Dst: Cisco_52:62:08 (00:19:55:52:62:08) Internet Protocol, Src: 10.74.52.92 (10.74.52.92), Dst: 10.77.21.166 (10.77.21.166) Transmission Control Protocol, Src Port: 34756 (34756), Dst Port: ftp (21), Seq: 1, Ack: 1, Len: 0
2. 服务器发来自己的标识
No. Time Source Destination Protocol Info 4 0.208322 10.77.21.166 10.74.52.92 FTP Response: 220 Microsoft FTP Service Frame 4: 93 bytes on wire (744 bits), 93 bytes captured (744 bits) Ethernet II, Src: Cisco_2c:6a:80 (00:18:74:2c:6a:80), Dst: Tp-LinkT_2c:b6:ef (00:19:e0:2c:b6:ef) Internet Protocol, Src: 10.77.21.166 (10.77.21.166), Dst: 10.74.52.92 (10.74.52.92) Transmission Control Protocol, Src Port: ftp (21), Dst Port: 34756 (34756), Seq: 1, Ack: 1, Len: 27 File Transfer Protocol (FTP) No. Time Source Destination Protocol Info 5 0.208365 10.74.52.92 10.77.21.166 TCP 34756 > ftp [ACK] Seq=1 Ack=28 Win=5888 Len=0 TSV=555948482 TSER=14500999 Frame 5: 66 bytes on wire (528 bits), 66 bytes captured (528 bits) Ethernet II, Src: Tp-LinkT_2c:b6:ef (00:19:e0:2c:b6:ef), Dst: Cisco_52:62:08 (00:19:55:52:62:08) Internet Protocol, Src: 10.74.52.92 (10.74.52.92), Dst: 10.77.21.166 (10.77.21.166) Transmission Control Protocol, Src Port: 34756 (34756), Dst Port: ftp (21), Seq: 1, Ack: 28, Len: 0
3. 客户端发送登录的用户名，这次用的是匿名登录
No. Time Source Destination Protocol Info 6 17125.849301 10.74.52.92 10.77.21.166 FTP Request: USER anonymous Frame 6: 82 bytes on wire (656 bits), 82 bytes captured (656 bits) Ethernet II, Src: Tp-LinkT_2c:b6:ef (00:19:e0:2c:b6:ef), Dst: Cisco_52:62:08 (00:19:55:52:62:08) Internet Protocol, Src: 10.74.52.92 (10.74.52.92), Dst: 10.77.21.166 (10.77.21.166) Transmission Control Protocol, Src Port: 34756 (34756), Dst Port: ftp (21), Seq: 1, Ack: 28, Len: 16 File Transfer Protocol (FTP) No. Time Source Destination Protocol Info 7 17125.952716 10.77.21.166 10.74.52.92 FTP Response: 331 Anonymous access allowed, send identity (e-mail name) as password. Frame 7: 138 bytes on wire (1104 bits), 138 bytes captured (1104 bits) Ethernet II, Src: Cisco_2c:6a:80 (00:18:74:2c:6a:80), Dst: Tp-LinkT_2c:b6:ef (00:19:e0:2c:b6:ef) Internet Protocol, Src: 10.77.21.166 (10.77.21.166), Dst: 10.74.52.92 (10.74.52.92) Transmission Control Protocol, Src Port: ftp (21), Dst Port: 34756 (34756), Seq: 28, Ack: 17, Len: 72 File Transfer Protocol (FTP) No. Time Source Destination Protocol Info 8 17125.952760 10.74.52.92 10.77.21.166 TCP 34756 > ftp [ACK] Seq=17 Ack=100 Win=5888 Len=0 TSV=560206650 TSER=14672252 Frame 8: 66 bytes on wire (528 bits), 66 bytes captured (528 bits) Ethernet II, Src: Tp-LinkT_2c:b6:ef (00:19:e0:2c:b6:ef), Dst: Cisco_52:62:08 (00:19:55:52:62:08) Internet Protocol, Src: 10.74.52.92 (10.74.52.92), Dst: 10.77.21.166 (10.77.21.166) Transmission Control Protocol, Src Port: 34756 (34756), Dst Port: ftp (21), Seq: 17, Ack: 100, Len: 0
4. 发送匿名用户的密码， 貌似是明文？
No. Time Source Destination Protocol Info 9 17560.816985 10.74.52.92 10.77.21.166 FTP Request: PASS NcFTP@ Frame 9: 79 bytes on wire (632 bits), 79 bytes captured (632 bits) Ethernet II, Src: Tp-LinkT_2c:b6:ef (00:19:e0:2c:b6:ef), Dst: Cisco_52:62:08 (00:19:55:52:62:08) Internet Protocol, Src: 10.74.52.92 (10.74.52.92), Dst: 10.77.21.166 (10.77.21.166) Transmission Control Protocol, Src Port: 34756 (34756), Dst Port: ftp (21), Seq: 17, Ack: 100, Len: 13 File Transfer Protocol (FTP) No. Time Source Destination Protocol Info 10 17560.928850 10.77.21.166 10.74.52.92 FTP Response: 230 Anonymous user logged in. Frame 10: 97 bytes on wire (776 bits), 97 bytes captured (776 bits) Ethernet II, Src: Cisco_2c:6a:80 (00:18:74:2c:6a:80), Dst: Tp-LinkT_2c:b6:ef (00:19:e0:2c:b6:ef) Internet Protocol, Src: 10.77.21.166 (10.77.21.166), Dst: 10.74.52.92 (10.74.52.92) Transmission Control Protocol, Src Port: ftp (21), Dst Port: 34756 (34756), Seq: 100, Ack: 30, Len: 31 File Transfer Protocol (FTP) No. Time Source Destination Protocol Info 11 17560.928894 10.74.52.92 10.77.21.166 TCP 34756 > ftp [ACK] Seq=30 Ack=131 Win=5888 Len=0 TSV=560314781 TSER=14676602 Frame 11: 66 bytes on wire (528 bits), 66 bytes captured (528 bits) Ethernet II, Src: Tp-LinkT_2c:b6:ef (00:19:e0:2c:b6:ef), Dst: Cisco_52:62:08 (00:19:55:52:62:08) Internet Protocol, Src: 10.74.52.92 (10.74.52.92), Dst: 10.77.21.166 (10.77.21.166) Transmission Control Protocol, Src Port: 34756 (34756), Dst Port: ftp (21), Seq: 30, Ack: 131, Len: 0
5.请求当前的路径
No. Time Source Destination Protocol Info 12 17810.419089 10.74.52.92 10.77.21.166 FTP Request: PWD Frame 12: 71 bytes on wire (568 bits), 71 bytes captured (568 bits) Ethernet II, Src: Tp-LinkT_2c:b6:ef (00:19:e0:2c:b6:ef), Dst: Cisco_52:62:08 (00:19:55:52:62:08) Internet Protocol, Src: 10.74.52.92 (10.74.52.92), Dst: 10.77.21.166 (10.77.21.166) Transmission Control Protocol, Src Port: 34756 (34756), Dst Port: ftp (21), Seq: 30, Ack: 131, Len: 5 File Transfer Protocol (FTP) No. Time Source Destination Protocol Info 13 17810.521822 10.77.21.166 10.74.52.92 FTP Response: 257 "/" is current directory. Frame 13: 97 bytes on wire (776 bits), 97 bytes captured (776 bits) Ethernet II, Src: Cisco_2c:6a:80 (00:18:74:2c:6a:80), Dst: Tp-LinkT_2c:b6:ef (00:19:e0:2c:b6:ef) Internet Protocol, Src: 10.77.21.166 (10.77.21.166), Dst: 10.74.52.92 (10.74.52.92) Transmission Control Protocol, Src Port: ftp (21), Dst Port: 34756 (34756), Seq: 131, Ack: 35, Len: 31 File Transfer Protocol (FTP) No. Time Source Destination Protocol Info 14 17810.521862 10.74.52.92 10.77.21.166 TCP 34756 > ftp [ACK] Seq=35 Ack=162 Win=5888 Len=0 TSV=560376825 TSER=14679098 Frame 14: 66 bytes on wire (528 bits), 66 bytes captured (528 bits) Ethernet II, Src: Tp-LinkT_2c:b6:ef (00:19:e0:2c:b6:ef), Dst: Cisco_52:62:08 (00:19:55:52:62:08) Internet Protocol, Src: 10.74.52.92 (10.74.52.92), Dst: 10.77.21.166 (10.77.21.166) Transmission Control Protocol, Src Port: 34756 (34756), Dst Port: ftp (21), Seq: 35, Ack: 162, Len: 0
6. 请求feature，貌似服务器不支持
No. Time Source Destination Protocol Info 15 18651.095674 10.74.52.92 10.77.21.166 FTP Request: FEAT Frame 15: 72 bytes on wire (576 bits), 72 bytes captured (576 bits) Ethernet II, Src: Tp-LinkT_2c:b6:ef (00:19:e0:2c:b6:ef), Dst: Cisco_52:62:08 (00:19:55:52:62:08) Internet Protocol, Src: 10.74.52.92 (10.74.52.92), Dst: 10.77.21.166 (10.77.21.166) Transmission Control Protocol, Src Port: 34756 (34756), Dst Port: ftp (21), Seq: 35, Ack: 162, Len: 6 File Transfer Protocol (FTP) No. Time Source Destination Protocol Info 16 18651.198840 10.77.21.166 10.74.52.92 FTP Response: 500 'FEAT': command not understood Frame 16: 102 bytes on wire (816 bits), 102 bytes captured (816 bits) Ethernet II, Src: Cisco_2c:6a:80 (00:18:74:2c:6a:80), Dst: Tp-LinkT_2c:b6:ef (00:19:e0:2c:b6:ef) Internet Protocol, Src: 10.77.21.166 (10.77.21.166), Dst: 10.74.52.92 (10.74.52.92) Transmission Control Protocol, Src Port: ftp (21), Dst Port: 34756 (34756), Seq: 162, Ack: 41, Len: 36 File Transfer Protocol (FTP) No. Time Source Destination Protocol Info 17 18651.198891 10.74.52.92 10.77.21.166 TCP 34756 > ftp [ACK] Seq=41 Ack=198 Win=5888 Len=0 TSV=560585832 TSER=14687505 Frame 17: 66 bytes on wire (528 bits), 66 bytes captured (528 bits) Ethernet II, Src: Tp-LinkT_2c:b6:ef (00:19:e0:2c:b6:ef), Dst: Cisco_52:62:08 (00:19:55:52:62:08) Internet Protocol, Src: 10.74.52.92 (10.74.52.92), Dst: 10.77.21.166 (10.77.21.166) Transmission Control Protocol, Src Port: 34756 (34756), Dst Port: ftp (21), Seq: 41, Ack: 198, Len: 0
7. 不知道这是啥命令
No. Time Source Destination Protocol Info 18 18888.285635 10.74.52.92 10.77.21.166 FTP Request: HELP SITE Frame 18: 77 bytes on wire (616 bits), 77 bytes captured (616 bits) Ethernet II, Src: Tp-LinkT_2c:b6:ef (00:19:e0:2c:b6:ef), Dst: Cisco_52:62:08 (00:19:55:52:62:08) Internet Protocol, Src: 10.74.52.92 (10.74.52.92), Dst: 10.77.21.166 (10.77.21.166) Transmission Control Protocol, Src Port: 34756 (34756), Dst Port: ftp (21), Seq: 41, Ack: 198, Len: 11 File Transfer Protocol (FTP) No. Time Source Destination Protocol Info 19 18888.392638 10.77.21.166 10.74.52.92 FTP Response: 214 Syntax: SITE (site-specific commands) Frame 19: 109 bytes on wire (872 bits), 109 bytes captured (872 bits) Ethernet II, Src: Cisco_2c:6a:80 (00:18:74:2c:6a:80), Dst: Tp-LinkT_2c:b6:ef (00:19:e0:2c:b6:ef) Internet Protocol, Src: 10.77.21.166 (10.77.21.166), Dst: 10.74.52.92 (10.74.52.92) Transmission Control Protocol, Src Port: ftp (21), Dst Port: 34756 (34756), Seq: 198, Ack: 52, Len: 43 File Transfer Protocol (FTP) No. Time Source Destination Protocol Info 20 18888.392677 10.74.52.92 10.77.21.166 TCP 34756 > ftp [ACK] Seq=52 Ack=241 Win=5888 Len=0 TSV=560644797 TSER=14689876 Frame 20: 66 bytes on wire (528 bits), 66 bytes captured (528 bits) Ethernet II, Src: Tp-LinkT_2c:b6:ef (00:19:e0:2c:b6:ef), Dst: Cisco_52:62:08 (00:19:55:52:62:08) Internet Protocol, Src: 10.74.52.92 (10.74.52.92), Dst: 10.77.21.166 (10.77.21.166) Transmission Control Protocol, Src Port: 34756 (34756), Dst Port: ftp (21), Seq: 52, Ack: 241, Len: 0
8. 同样不知道这是啥命令
No. Time Source Destination Protocol Info 21 19426.362670 10.74.52.92 10.77.21.166 FTP Request: CLNT NcFTP 3.2.4 linux-x86-glibc2.6 Frame 21: 103 bytes on wire (824 bits), 103 bytes captured (824 bits) Ethernet II, Src: Tp-LinkT_2c:b6:ef (00:19:e0:2c:b6:ef), Dst: Cisco_52:62:08 (00:19:55:52:62:08) Internet Protocol, Src: 10.74.52.92 (10.74.52.92), Dst: 10.77.21.166 (10.77.21.166) Transmission Control Protocol, Src Port: 34756 (34756), Dst Port: ftp (21), Seq: 52, Ack: 241, Len: 37 File Transfer Protocol (FTP) No. Time Source Destination Protocol Info 22 19426.465881 10.77.21.166 10.74.52.92 FTP Response: 500 'CLNT NcFTP 3.2.4 linux-x86-glibc2.6': command not understood Frame 22: 133 bytes on wire (1064 bits), 133 bytes captured (1064 bits) Ethernet II, Src: Cisco_2c:6a:80 (00:18:74:2c:6a:80), Dst: Tp-LinkT_2c:b6:ef (00:19:e0:2c:b6:ef) Internet Protocol, Src: 10.77.21.166 (10.77.21.166), Dst: 10.74.52.92 (10.74.52.92) Transmission Control Protocol, Src Port: ftp (21), Dst Port: 34756 (34756), Seq: 241, Ack: 89, Len: 67 File Transfer Protocol (FTP) No. Time Source Destination Protocol Info 23 19426.465939 10.74.52.92 10.77.21.166 TCP 34756 > ftp [ACK] Seq=89 Ack=308 Win=5888 Len=0 TSV=560778555 TSER=14695257 Frame 23: 66 bytes on wire (528 bits), 66 bytes captured (528 bits) Ethernet II, Src: Tp-LinkT_2c:b6:ef (00:19:e0:2c:b6:ef), Dst: Cisco_52:62:08 (00:19:55:52:62:08) Internet Protocol, Src: 10.74.52.92 (10.74.52.92), Dst: 10.77.21.166 (10.77.21.166) Transmission Control Protocol, Src Port: 34756 (34756), Dst Port: ftp (21), Seq: 89, Ack: 308, Len: 0
ok，整个过程结束，算是登录成功了。
