Book Image

Wireshark 2 Quick Start Guide

By : Charit Mishra
Book Image

Wireshark 2 Quick Start Guide

By: Charit Mishra

Overview of this book

<p>Wireshark is an open source protocol analyser, commonly used among the network and security professionals. Currently being developed and maintained by volunteer contributions of networking experts from all over the globe. Wireshark is mainly used to analyze network traffic, analyse network issues, analyse protocol behaviour, etc. - it lets you see what's going on in your network at a granular level. This book takes you from the basics of the Wireshark environment to detecting and resolving network anomalies.</p> <p>This book will start from the basics of setting up your Wireshark environment and will walk you through the fundamentals of networking and packet analysis. As you make your way through the chapters, you will discover different ways to analyse network traffic through creation and usage of filters and statistical features. You will look at network security packet analysis, command-line utilities, and other advanced tools that will come in handy when working with day-to-day network operations.</p> <p>By the end of this book, you have enough skill with Wireshark 2 to overcome real-world network challenges.</p>
Table of Contents (14 chapters)
Title Page
Packt Upsell
Contributors
Preface
8
Mastering the Advanced Features of Wireshark
Index

File transfer protocol


Since the internet came into existence, we have been working with the file transfer protocol (FTP). FTP uses TCP over port 21 or 20 (by default) to initiate and transfer files over a designated channel. There are only two types channel command channel (port 21) and data channel (port 20). The command channel is used to send and receive the commands and their responses. The data channel is used to send and receive data between the client and the server. However, you will observe random port numbers used to transfer TCP data segments from your client machine.

Dissecting FTP communication packets

There are two types of mode a client can use to communicate with a server: active and passive. In earlier versions of FTP server applications, active mode was enabled by default, but in the latest versions of FTP server applications, passive mode is enabled by default. For understanding these modes in detail, let's use the following scenario.

Let's say an FTP server is configured...