Just implementing a FTP server and use wireshark to analize the protocol. I find there is a protocol identified by wireshark
FTP-DATA. What is that? Any document or RFC can be referred?
Thanks and Best Regards.
To my knowledge, that port is usually negotiated before transfer. I don't know if Wireshark uses a fixed value of
Please note that what Wireshark calls a protocol is something like TCP.
So, it's a static lookup approach from port number to service. The information is basically meaningless.
There are 2 ports associated with the FTP protocol. They are 20 and 21 with 20 being the channel in which the data travels over(ftp-data) while port 21 is the port that the control messages are sent over (i.e 200 OK).
There are also differences regarding passive or active mode with passive using a random high port for data trasfer.
Also keep in mind ftp by default is plain text and easily intercepted over the wire. If this FTP solution is not inside your LAN's foot print I would recommend sftp, ftp over vpn or scp for moving files to and from the server.