The Technology Firm Started at an User Group Meeting FTP Notes

1. The Technology FirmStarted at an User Group MeetingFTP Notes

2. What is FTP • RFC959 • The File Transfer Protocol (FTP) provides file transfer capability between hosts. FTP uses TCP to create a virtual connection for control information and then creates a separate TCP connection for data transfers. • The control connection uses an image of the TELNET protocol to exchange commands and messages between hosts.

3. The FTP Model (as per RFC 959) User Interface FTP Commands/Replies Server Protocol Interpreter (PI) User Protocol Interpreter (PI) TCP Port 21 File System File System Server Data Transfer Process (DTP) User Data Transfer Process (DTP) FTP Data TCP Port 20

4. The Protocol Interpreter • Server Protocol Interpreter listens on port 21 for the Client Protocol Interpreter’s request. • The ‘Control Connection’ uses this communication path. • Connection follows Telnet Protocol. 3 Way Handshake Login and other commands Client PC Server FTP FTP Data TCP Port 20 FTP Control TCP Port 21 FTP Control TCP Port 21 FTP Data TCP Port 20

5. The Data Transfer Process • The data transfer process establishes and manages the data connection. The DTP can be passive or active. • When the client initiates a control connection on TCP port 21 and the server opens TCP port 20 for data, this is called an Active Connection. • When the client initiates a control connection on TCP port 21 and the server opens a random TCP port for data (via the PASSV command), this is called an Passive Connection. Client PC Server FTP Download FTP Data TCP Port 20 FTP Control TCP Port 21 FTP Data TCP Port 20 FTP Control TCP Port 21

6. Specifying the Transfer Mode • Transferring data between dissimilar systems often requires transformations of the data as part of the transfer process. The user has to decide on two aspects of the data handling: • The way the bits will be moved from one place to another. • The different representations of data upon the system's architecture. • This is controlled using the following subcommands: • Mode - Specifies whether the file is to be treated as having a record structure in a byte stream format. • Block – Data is sent as a series of data blocks preceded by header bytes. • Stream - The file is treated as a byte stream and record structures are allowed. This is the default, and provides more efficient transfer but may not produce the desired results when working with a record-based file system. • Compressed – Filler and data is compressed. • Type - Specifies the character sets used for the data. • ASCII - Indicates that both hosts are ASCII-based, or that if one is ASCII-based and the other is EBCDIC-based, that ASCII-EBCDIC translation should be performed. • EBCDIC - Indicates that both hosts use an EBCDIC data representation. • Image - Indicates that data is to be treated as contiguous bits packed in 8-bit bytes. • Because these subcommands do not cover all possible differences between systems, the SITE subcommand is available to issue implementation-dependent commands.

7. 7 7 7 1 1 1 FTP Data Types • ASCII – Default for Text Files S U E bits • EBCDIC – Used for IBM Text Files S U E 8 8 8 bits • IMAGE – Used to exchange data between similar workstations 10101100 10101100 10101100 8 8 8 bits

8. FTP Access Control Commands • ACCT <account> Account for system privileges. • PASS <password> Password for system log-in. • USER <username> User name for system log-in. • REIN Reinitialize connection to log-in status. • QUIT Log off from the FTP server.

9. FTP Transfer Commands • PORT <address> IP address and two-byte system port ID. • PASV Request server wait for data connection. • TYPE <data type> Data type (A=ASCII, E=EBCDIC, I=binary). • STRU <type> Data structure (F=file, R=record, P=page). • MODE <mode> Transfer mode (S=stream, B=block, C=compressed).

10. FTP Service Commands • ABOR Abort data connection process. • ALLO <bytes> Allocate bytes for file storage on server. • APPE <filename> Append file to file of same name on server. • CWD <dir path> Change working directory on server. • DELE <filename> Delete specified file on server. • HELP <command> Return information on specified command. • LIST <name> List file or directory details. • NLST <directory> List contents of specified directory. • NOOP Cause no action other than acknowledgment from server. • SITE <params> Site specific parameters provided by server. • STAT <directory> Return information on current process or directory. • STOR <filename> Store (copy) file to server. • RETR <filename> Retrieve (copy) file from server. • REST <offset> Restart file transfer from given offset. • RNFR <old path> Rename from old path. • RNTO <new path> Rename to new path. • RMD <directory> Remove specified directory on server. • CDUP <dir path> Change to parent directory on server. • MKD <directory> Create specified directory on server. • PWD Display current working directory. • SMNT <pathname> Mount the specified file structure. • SYST Return operating system used by server.

11. Response Code Explanation • If you send a command to an FTP server, you will receive a three-digit response code (ABC) describing how the server processed your command: • Details for A: • 1 = the command was successful, but you need to wait for another response code before issuing your next command. • 2 = the successful completion of a command. • 3 = the server needs more information before it can complete the request. • 4 = the system was too busy to process the command and that you should try again later. • 5 = some kind of error; you should resolve the error before trying the command again. • Details B: • 1 = File status or help • 2 = Connection status • 3 = User information • 4 = Unspecified • 5 = Action not taken • Details C: • More details, if required.

12. FTP Response Codes Response Explanatory Code Text 110 Restart marker at MARK yyyy=mmmm (new file pointers). 120 Service ready in nnn minutes. 125 Data connection open, transfer starting. 150 Open connection. 200 OK. 202 Command not implemented. 211 (System status reply). 212 (Directory status reply). 213 (File status reply). 214 (Help message reply). 215 (System type reply). 220 Service ready. 221 Log off network. 225 Data connection open. 226 Close data connection. 227 Enter passive mode (IP address, port ID). 230 Log on network. 250 File action completed. 257 Path name created. 331 Password required. 332 Account name required.

13. FTP Response Codes Response Explanatory Code Text 332 Account name required. 350 File action pending. 421 Service shutting down. 425 Cannot open data connection. 426 Connection closed. 450 File unavailable. 451 Local error encountered. 452 Insufficient disk space. 500 Invalid command. 501 Bad parameter. 502 Command not implemented. 503 Bad command sequence. 504 Parameter invalid for command. 530 Not logged onto network. 532 Need account for storing files. 550 File unavailable. 551 Page type unknown. 552 Storage allocation exceeded. 553 File name not allowed.

14. FTP Browser Syntax Example ftp://username:password@ftp.microsoft.com

15. No. Source Destination Protocol Info 1 209.90.146.26 216.254.136.5 DNS Standard query A ftp.mcafee.com 2 216.254.136.5 209.90.146.26 DNS Standard query response CNAME ftp.nai.com A 161.69.2.23 3 209.90.146.26 ftp.nai.com TCP 1341 > ftp [SYN] Seq=6311818 Ack=0 Win=17600 Len=0 4 ftp.nai.com 209.90.146.26 TCP ftp > 1341 [SYN, ACK] Seq=586858563 Ack=6311819 Win=16616 Len=0 5 209.90.146.26 ftp.nai.com TCP 1341 > ftp [ACK] Seq=6311819 Ack=586858564 Win=17600 Len=0 6 ftp.nai.com 209.90.146.26 FTP Response: 220 sncwebftp6 Microsoft FTP Service (Version 5.0). 7 209.90.146.26 ftp.nai.com TCP 1341 > ftp [ACK] Seq=6311819 Ack=586858617 Win=17547 Len=0 8 209.90.146.26 ftp.nai.com FTP Request: USER anonymous 9 ftp.nai.com 209.90.146. 26 FTP Response: 331 Anonymous access allowed, send identity (e-mail name) as password. 10 209.90.146.26 ftp.nai.com TCP 1341 > ftp [ACK] Seq=6311835 Ack=586858689 Win=17475 Len=0 11 209.90.146.26 ftp.nai.com FTP Request: PASS tony@testing.com 12 ftp.nai.com 209.90.146.26 FTP Response: 230-You are connected to ftp.nai.com. 13 209.90.146.26 ftp.nai.com TCP 1341 > ftp [ACK] Seq=6311858 Ack=586858729 Win=17435 Len=0 14 ftp.nai.com 209.90.146.26 FTP Response: 230-Your use is subject to the terms and conditions 15 209.90.146.26 ftp.nai.com TCP 1341 > ftp [ACK] Seq=6311858 Ack=586858913 Win=17251 Len=0 Control Data uses Port 21. With this analyzer, TCP Port 21 is labeled as ‘ftp’. Anatomy Of A FTP Setup Conversation DNS NAME LOOKUP 3 Way Handshake Login ID Password Output from Ethereal

16. 16 209.90.146.26 ftp.nai.com FTP Request: PORT 209,90,146,26,5,62 17 ftp.nai.com 209.90.146.26 FTP Response: 200 PORT command successful. 18 209.90.146.26 ftp.nai.com FTP Request: RETR legal.txt 19 ftp.nai.com 209.90.146.26 FTP Response: 150 Opening ASCII mode data connection for legal.txt(1466 bytes). 20 ftp.nai.com 209.90.146.26 TCP ftp-data > 1342 [SYN] Seq=597748893 Ack=0 Win=16384 Len=0 21 209.90.146.26 ftp.nai.com TCP 1342 > ftp-data [SYN, ACK] Seq=6332164 Ack=597748894 Win=17600 Len=0 22 209.90.146.26 ftp.nai.com TCP 1341 > ftp [ACK] Seq=6311899 Ack=586859010 Win=17154 Len=0 23 ftp.nai.com 209.90.146.26 TCP ftp-data > 1342 [ACK] Seq=597748894 Ack=6332165 Win=16616 Len=0 24 ftp.nai.com 209.90.146.26 FTP- DATA FTP Data: 536 bytes 25 ftp.nai.com 209.90.146.26 FTP- DATA FTP Data: 536 bytes 26 209.90.146.26 ftp.nai.com TCP 1342 > ftp-data [ACK] Seq=6332165 Ack=597749966 Win=17600 Len=0 27 ftp.nai.com 209.90.146.26 FTP- DATA FTP Data: 394 bytes 28 209.90.146.26 ftp.nai.com TCP 1342 > ftp-data [ACK] Seq=6332165 Ack=597750361 Win=17206 Len=0 29 209.90.146.26 ftp.nai.com TCP 1342 > ftp-data [FIN, ACK] Seq=6332165 Ack=597750361 Win=17206 Len=0 30 ftp.nai.com 209.90.146.26 FTP Response: 226 Transfer complete. 31 ftp.nai.com 209.90.146.26 TCP ftp-data > 1342 [ACK] Seq=597750361 Ack=6332166 Win=16616 Len=0 32 209.90.146.26 ftp.nai.com TCP 1341 > ftp [ACK] Seq=6311899 Ack=586859034 Win=17130 Len=0 33 209.90.146.26 ftp.nai.com FTP Request: QUIT 34 ftp.nai.com 209.90.146.26 TCP ftp > 1341 [FIN, ACK] Seq=586859072 Ack=6311905 Win=16530 Len=0 35 ftp.nai.com 209.90.146.26 FTP Response: 221 Thanks for using ftp.nai.com! 36 209.90.146.26 ftp.nai.com TCP 1341 > ftp [ACK] Seq=6311905 Ack=586859034 Win=17130 Len=0 37 209.90.146.26 ftp.nai.com TCP 1341 > ftp [ACK] Seq=6311905 Ack=586859073 Win=17092 Len=0 38 209.90.146.26 ftp.nai.com TCP 1341 > ftp [FIN, ACK] Seq=6311905 Ack=586859073 Win=17092 Len=0 39 ftp.nai.com 209.90.146.26 TCP ftp > 1341 [ACK] Seq=586859073 Ack=6311906 Win=16530 Len=0 FTP Data uses Port 20. With this analyzer, TCP Port 20 is labeled as ‘ftp-data’. Since this connection uses TCP port 20/21, this is called a Active Connection. Anatomy Of An Active Conversation 5 x256 + 62 = 1342. This number Will define the TCP file transfer connection port number. The first four comma-delimited numbers represent the IP address. Output from Sniffer Pro

17. FTP Data uses Port 20. Since this connection uses TCP port 4150, this is called a Passive Connection. Anatomy Of An Passive Conversation 16 x256 + 54 = 4150. This number will define the TCP file transfer connection port number. The first four comma-delimited numbers represent the IP address.