How to capture ftp traffic on the network

[Becke]

Hi Guys,

I'm only interested in capturing the ftp traffic on the network, so I can log and monitor the ftp activity for a week.

Please advise how do i capture ftp activity on the system.

Cheers,
Raf

[renarios · Accepted solution]

Hi Raf,

I know that there's a tool called RRDtool (round robin database tool).

Hope it helps,

Renarios

[twang]

Binary tcpdump traces could be interesting to examine with tcptrace/xplot. The following example that will listen on lan0 for traffic on port 21 and write the output to file /tmp/ftp.log

# tcpdump -i lan0 -n port 21 -w /tmp/ftp.log

[Patrick Wallek]

You must remember that for ALL ftp traffic you must listen on ports 20 and 21 both. Port 20 is the FTP data port and 21 is the control port.

[Biswajit Tripathy]

As Patrick Wallek said, you must listen to port 21
AND port 20.

It gets a little more complicated when the user is
using passive FTP as with passive FTP, _both_
the port numbers for data connections are
generated dynamically. So you need to process the
tcpdump output (by writing a script) that catches
the passive data connection negotiation (by the
control connection to port 21) and track those ports
too. Can get a little more complicated.

If you donot allow passive FTP, then tracking
port 20 and 21 will be enough.

- Biswajit