how to use wireshark linux to view network traffic

Apply tcp filter to see the first three packets in the Packet list panel. Use Ctrl+C to stop the capture and look for the FTP session initiation, followed by the tcp, , and packets illustrating a three-way handshake for a reliable session. Log-in with your credentials, as shown in the screenshot below. Start packet capture from your selected interface and use the ftp command in the terminal to access the site. Hence, we will begin our analysis with the available TCP packet information for the FTP session initiation and termination in the middle pane. For every datagram exchange, TCP initiates a new session between the FTP client and the FTP server. TCP is generally used in every session to control datagram delivery, arrival, and window size management. The FTP client and server communicate while being unaware that TCP manages every session. Later a separate data connection is established to transfer files and folders. Such servers are known as anonymous FTP servers. But some servers make all of their content available without any credentials. A control connection requires a login to establish a connection. The FTP client first builds a control connection request to the server port 21. As HTTP is built for Websites, FTP is optimized for large file transfers between computers.

Simply put, it’s a way to share files between connected computers. FTPįTP is a protocol used by computers to share information over the network.

Before we dig deep into the captured packet analysis, we will begin with a brief understanding of the protocol. In this article, we will learn how FTP works and examine FTP Wireshark captures. The previous article has provided you with an in-depth understanding of the Wireshark filters, OSI layers, ICMP, and HTTP packet analysis.

How to use wireshark linux to view network traffic