This info was useful to me as well. Do you mean that at TCP segment
level, ethereal decodes the packet to read the port number (see if it is
20 or 21) or does ethereal gets it from somewhere else? Please let me
know. Also, the "PASV" mode of operation, I am unsure from which level
packet (L-3 or L-4...)it gets such info?
Thanks,
Sri.
-----Original Message-----
From: ethereal-dev-bounces@xxxxxxxxxxxx
[mailto:ethereal-dev-bounces@xxxxxxxxxxxx] On Behalf Of LEGO
Sent: Monday, July 18, 2005 9:55 PM
To: Ethereal development
Subject: Re: [Ethereal-dev] Protocol Identification
it "reads" the parameters of the PORT or PASV commands to create a
conversation. From there on every packet that "matches" the
conversation is "known" to be ftp-data.
On 7/18/05, Duncan Godfrey <d.j.godfrey@xxxxxxxxxxxxx> wrote:
> Would some be able to help me with a quick question, how does Ethereal
> identify FTP-Data packets - specificaly the ones which don't use
either
> source or destination port 20 that is.
>
> I have been going through the source but Im a bit overwhelmed and cant
> locate the section with the packet analysis.
>
> Thank you in advance for any help,
>
> Duncan Godfrey
>
> _______________________________________________
> Ethereal-dev mailing list
> Ethereal-dev@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-dev
>
--
This information is top security. When you have read it, destroy
yourself.
-- Marshall McLuhan
_______________________________________________
Ethereal-dev mailing list
Ethereal-dev@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-dev
DISCLAIMER:
This email (including any attachments) is intended for the sole use of the intended recipient/s and may contain material that is CONFIDENTIAL AND PRIVATE COMPANY INFORMATION. Any review or reliance by others or copying or distribution or forwarding of any or all of the contents in this message is STRICTLY PROHIBITED. If you are not the intended recipient, please contact the sender by email and delete all copies; your cooperation in this regard is appreciated.
