FTP Example 2: Passive Mode

• 1079240274.421087 | IP 192.168.1.102->64.12.168.249 (len:46,id:55784,DF,frag:0) | TCP 2757->21 (PA,2691814085,2158588927,65088) FTP control PASV

• 1079240274.456489 | IP 64.12.168.249->192.168.1.102 (len:90,id:30195,frag:0) | TCP 21->2757 (PA,2158588927,2691814091,65320) FTP control 227 Entering Passive Mode (64,12,168,249,209,52)

• 1079240274.461911 | IP 192.168.1.102->64.12.168.249 (len:48,id:55785,DF,frag:0) | TCP 2760->53556 (S,2695923328,0,64240) <maximum segment size 1460><SACK permitted>

• 1079240274.497896 | IP 64.12.168.249->192.168.1.102 (len:48,id:30196,frag:0) | TCP 53556->2760 (SA,2187253986,2695923329,65320) <SACK permitted><maximum segment size 1420>

• 1079240274.498008 | IP 192.168.1.102->64.12.168.249 (len:40,id:55786,DF,frag:0) | TCP 2760->53556 (A,2695923329,2187253987,65320)

• 1079240274.555099 | IP 192.168.1.102->64.12.168.249 (len:54,id:55793,DF,frag:0) | TCP 2757->21 (PA,2691814091,2158588977,65038) FTP control RETR Welcome

• 1079240274.594648 | IP 64.12.168.249->192.168.1.102 (len:106,id:30197,frag:0) | TCP 21->2757 (PA,2158588977,2691814105,65320) FTP control 150 Opening BINARY mode data connection for Welcome (351 bytes).

• 1079240274.611278 | IP 64.12.168.249->192.168.1.102 (len:391,id:30198,frag:0) | TCP 53556->2760 (PA,2187253987,2695923329,65320)

• 1079240274.611368 | IP 64.12.168.249->192.168.1.102 (len:40,id:30199,frag:0) | TCP 53556->2760 (FA,2187254338,2695923329,65320)

• 1079240274.611424 | IP 192.168.1.102->64.12.168.249 (len:40,id:55794,DF,frag:0) | TCP 2760->53556 (A,2695923329,2187254339,64969)

• 1079240274.612101 | IP 192.168.1.102->64.12.168.249 (len:40,id:55795,DF,frag:0) | TCP 2760->53556 (FA,2695923329,2187254339,64969)

• 1079240274.656234 | IP 64.12.168.249->192.168.1.102 (len:40,id:30200,frag:0) | TCP 53556->2760 (A,2187254339,2695923330,65320)