Re: How do I identify SSL secured FTP session?

[Stephen Fisher <steve () stephen-fisher com>]

On Sat, Feb 12, 2011 at 03:43:34PM -0600, David Alanis wrote:

> I forgot the most important part of your question. Once you have the 
> Wireshark capture and if you simply apply the view filter 'ftp' and 
> displays your entire connection. Then you know your FTP session is not 
> encrypted, hence ftp displays communication over port 21 and maybe 20?
>
> I didn't see FTP listed under preferences > protocols.

The FTP dissector is hard-coded to handle two types of FTP traffic: FTP 
commands on port 21 and FTPDATA on port 20.  You should be able to right 
click on a packet and do "Decode as..." FTP also though.

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe