Wireshark-users: Re: [Wireshark-users] capture filter tcp port 20 and port 21

From: Becky Vict <becky_vict@xxxxxxxxx>
Date: Mon, 18 Sep 2006 03:40:09 -0700 (PDT)
thank you jaap and ulf.

i had tried this --> tcp port 20 or tcp port 21 and it works beautifully!

ulf, if i use active mode, would my data port be negotiated for every transfer?

thanks.

Ulf Lamping <ulf.lamping@xxxxxx> wrote:


>
> i want to capture ftp download from a server to a client. what is the capture filter to be used at both server and client so i can get only traffic from/to port 20 and port 21?
>
> i tried this --> tcp port 20 and tcp port 21 but no traffic is captured.
>

The correct syntax for what you thought of would be: tcp port 20 or tcp port 21

However, As the data port will often be negotiated (aka varies from transfer to transfer), you'll often won't be able to use a capture filter for this as you won't capture the data portion, see: http://wiki.wireshark.org/FTP

Regards, ULFL
_____________________________________________________________________
Der WEB.DE SmartSurfer hilft bis zu 70% Ihrer Onlinekosten zu sparen!
http://smartsurfer.web.de/?mc=100071&distributionid=000000000066

_______________________________________________
Wireshark-users mailing list
Wireshark-users@xxxxxxxxxxxxx
http://www.wireshark.org/mailman/listinfo/wireshark-users


Do you Yahoo!?
Everyone is raving about the all-new Yahoo! Mail.