DNS FTP Server FTP Client Console
This sequence diagram was generated with EventStudio System Designer (http://www.EventHelix.com/EventStudio).
Here we explore the sequence of interactions in a typical FTP (File Transfer Protocol) session.
The example here illustrates the use of multiple TCP connections by FTP. We will cover how FTP
establishes a telnet TCP connection (TCP Port 21) to control the overall flow of the FTP transfer.
Then we examine the use of TCP Port 20 for establishing TCP connections for
directory transfer and file retrieval.
The complete sequence diagram can be divided into the following steps:
- DNS Query to obtain the IP address for the FTP Server
- FTP Telnet connection setup and login. (USER and PASS commands)
- Obtaining a directory listing (PORT and LIST command)
- Changing directory (CWD command)
- Downloading a file using FTP get (PORT and RETR command)
Copyright © 2013 EventHelix.com Inc. All Rights Reserved.
DNS Query to obtain the IP address for the FTP Server.
DNS Query
recdesired = 1, queries = 1, name = ftp.any-domain.com, type = A, class = IN
DNS Response
recdesired = 1, answers = 1, IP Address
FTP Telnet connection setup and login. (USER and PASS commands).
TCP connection establishment over the control port
TCP SYN
srcport = 1175, dstport = 21, syn = 1
TCP SYN+ACK
srcport = 21, dstport = 1175, syn = 1, ack = 1
TCP ACK
srcport = 1175, dstport = 21, ack = 1
Logging in
Display login prompt and get user name
FTP 220
ftp.response.code = 220, ftp.response.arg = ANY-DOMAIN.COM FTP Service
Display welcome message
TCP ACK
srcport = 1175, dstport = 21, ack = 1
Enter login information
USER ftp
TCP ACK
srcport = 21, dstport = 1175, ack = 1
FTP 331
code = 331, arg = Anonymous access allowed, send identity (e-mail name) as
password.
Display password prompt and complete login
DNS FTP Server FTP Client Console
Password prompt
TCP ACK
srcport = 1175, dstport = 21, ack = 1
Password information
PASS [email protected]
TCP ACK
srcport = 21, dstport = 1175, ack = 1
FTP 230
code = 230, arg = Welcome to ftp.any-domain.com
FTP 230
code = 230, arg = Anonymous user logged in.
Login successful prompt
TCP ACK
srcport = 1175, dstport = 21, ack = 1
Obtaining a directory listing (PORT and LIST command).
User requests directory listing
dir command
PORT 192.168.0.2 Port 5001
TCP ACK
srcport = 21, dstport = 1175, ack = 1
FTP 200
code = 200, arg = PORT command successful.
LIST
seq-251
srcport = 21, dstport = 1175, ack = 1
FTP 150
ftp.response.code = 150, ftp.response.arg = Opening ASCII mode data
connection for /bin/ls.
Establish data port connection to transfer directory listing
TCP SYN
srcport = 20, dstport = 5001, syn = 1
TCP SYN+ACK
srcport = 5001, dstport = 20, syn = 1, ack = 1
TCP ACK
srcport = 20, dstport = 5001, ack = 1
Display directory listing
FTP 226
ftp.response.code = 226, ftp.response.arg = Transfer complete.
DNS FTP Server FTP Client Console
TCP ACK
srcport = 1175, dstport = 21, ack = 1
TCP ACK
srcport = 20, dstport = 5001, ack = 1
Display directory listing
Release the data port TCP connection on completion of the directory listing
TCP FIN+ACK
tcp.srcport = 20, tcp.dstport = 5001, tcp.flags.ack = 1, tcp.flags.fin = 1
TCP ACK
tcp.srcport = 5001, tcp.dstport = 20, tcp.flags.ack = 1
TCP FIN+ACK
tcp.srcport = 5001, tcp.dstport = 20, tcp.flags.ack = 1, tcp.flags.fin = 1
TCP ACK
tcp.srcport = 20, tcp.dstport = 5001, tcp.flags.ack = 1
Changing directory (CWD command).
Change working directory (cwd)
CWD <directory-name>
TCP ACK
tcp.srcport = 21, tcp.dstport = 1175, tcp.flags.ack = 1
250 CWD Successful
code = 250, arg = CWD command successful.
TCP ACK
tcp.srcport = 1175, tcp.dstport = 21, ack = 1
Downloading a file using FTP get (PORT and RETR command).
Requesting file over the TCP control port
FTP get for readme.txt
PORT 192.168.0.2 Port 5002
TCP ACK
tcp.srcport = 21, tcp.dstport = 1175, ack = 1
PORT 192.168.0.2 Port 5002
RETR readme.txt
TCP ACK
tcp.srcport = 21, tcp.dstport = 1175, ack = 1
FTP 150
code = 150, arg = Opening ASCII mode data connection for readme.txt(1715
bytes).
Setting up the data TCP connection (3 way handshake)
DNS FTP Server FTP Client Console
TCP SYN
tcp.srcport = 20, tcp.dstport = 5002, syn = 1, ack = 0, fin = 0
TCP SYN+ACK
tcp.srcport = 5002, tcp.dstport = 20, syn = 1, ack = 1
TCP ACK
tcp.srcport = 20, tcp.dstport = 5002, ack = 1
Transfering the file over the data TCP connection
FTP DATA
tcp.srcport = 20, tcp.dstport = 5002, ack = 1
FTP DATA
tcp.srcport = 20, tcp.dstport = 5002, ack = 1
TCP ACK
tcp.srcport = 5002, tcp.dstport = 20, ack = 1
FTP DATA
tcp.srcport = 20, tcp.dstport = 5002, ack = 1
FTP DATA
tcp.srcport = 20, tcp.dstport = 5002, ack = 1
TCP ACK
tcp.srcport = 5002, tcp.dstport = 20, ack = 1
Releasing the data TCP connection
FTP DATA+FIN
tcp.srcport = 20, tcp.dstport = 5002, ack = 1, fin = 1
TCP ACK
tcp.srcport = 5002, tcp.dstport = 20, ack = 1
TCP FIN+ACK
tcp.srcport = 5002, tcp.dstport = 20, ack = 1, fin = 1
TCP ACK
tcp.srcport = 20, tcp.dstport = 5002, ack = 1
Signal completion of the FTP over the control port
TCP ACK
tcp.srcport = 1175, tcp.dstport = 21, ack = 1
FTP 226
code = 226, arg = Transfer complete.
Display transfer complete indication
TCP ACK
tcp.srcport = 1175, tcp.dstport = 21, ack = 1
Logging out
DNS FTP Server FTP Client Console
Quitting the FTP client
Exit FTP client using bye command
QUIT
ftp.request.command = QUIT
TCP ACK
tcp.srcport = 21, tcp.dstport = 1175, ack = 1
FTP 221
code = 221, arg = Thank you for visiting ftp.any-domain.com.
TCP ACK
tcp.srcport = 1175, tcp.dstport = 21, ack = 1
Releasing the control TCP connection
TCP FIN
tcp.srcport = 21, tcp.dstport = 1175, ack = 1, fin = 1
TCP ACK
tcp.srcport = 1175, tcp.dstport = 21, ack = 1, fin = 1
TCP FIN
tcp.srcport = 1175, tcp.dstport = 21, ack = 1, fin = 1
TCP ACK
tcp.srcport = 21, tcp.dstport = 1175, ack = 1, fin = 1
This sequence diagram was generated with EventStudio System Designer (http://www.EventHelix.com/EventStudio).