trace ftp file data in wireshark

Question

I am trying to analyze ftp traffic in Wireshark. I can see commands like Request: List, PORT. But after FTP

Response 150: Opening data channel for directory list.

what I see immediately is

Response 226: Transfer OK

where is a list of files? Why I don't see it? (I've got this list - I can see it in terminal)

Solution

You're following a single TCP connection. FTP data transfers occur over a second connection. Stop following the connection (or filtering) and you should see the data transfer, assuming you didn't use capture filters and actually captured it.

Comments

[Eduardo]

I tried this way but cannot find it. What filters might help? I tried by port 21 and second port of connection

[Michael Hampton]

As I already said, you'll miss it if you filter by port 21. Try not filtering at all, or filtering by IP address.

[Eduardo]

It might be more complicated in this case because it goes from my machine through TP-Link to my server and back. In FTP-Data frame I see TP-Link as source, not server which is behind TP-Link

[suprjami]

That's right, because the frame (layer 2) comes from your router (TP-Link).