Wireshark之FTP协议分析（一）

最近项目需求，需要抓取并还原网络中通过ftp传输的文件。故对ftp协议进行了简单学习，总结如下。

1. ftp协议概述

这部分内容我参考的百度文库的一篇文档：

https://wenku.baidu.com/view/fef7d6d658fb770bf68a55ae.html

里面讲的很详细。在此对重点的部分进行总结一下。

1）ftp服务端的用到两个端口20和21。

2）FTP使用不同的端口号传输不同的内容，会建立不同的TCP连接。首先，使用 TCP 生成一个虚拟连接用于控制信息，然后再生成一个单独的 TCP 连接用于数据传输。

3）FTP有两种工作模式，分别是主动模式(PORT)和被动模式(PASV)两种模式，这两种模式是按照FTP服务器的“角度”来说的，更通俗一点说就是：在传输数据时，如果是服务器主动连接客户端，那就是主动模式；如果是客户端主动连接服务器，那就是被动模式。主动模式下，服务端采用端口20做数据连接。

4）目前ftp客户端与服务端的 传输方式为流方式，传输类型为ASCII或是二进制，传输结构为文件结构（文件被认为一个连续的字节流）。

5）ftp命令

    ftp命令和应答在客户和服务端的控制连接上以NVT ASCII码（百度了解）形式传输。

     从客户发送给服务端的ftp命令超过30种，这些命令都是3或4个字节的大写ASCII字符，其中一些带选项参数。我从Wikipedia中拷贝过来如下：

Command	RFC	Description
ABOR		Abort an active file transfer.
ACCT		Account information.
ADAT	RFC 2228	Authentication/Security Data
ALLO		Allocate sufficient disk space to receive a file.
APPE		Append (with create)
AUTH	RFC 2228	Authentication/Security Mechanism
AVBL	Streamlined FTP Command Extensions	Get the available space
CCC	RFC 2228	Clear Command Channel
CDUP		Change to Parent Directory.
CONF	RFC 2228	Confidentiality Protection Command
CSID	Streamlined FTP Command Extensions	Client / Server Identification
CWD	RFC 697	Change working directory.
DELE		Delete file.
DSIZ	Streamlined FTP Command Extensions	Get the directory size
ENC	RFC 2228	Privacy Protected Channel
EPRT	RFC 2428	Specifies an extended address and port to which the server should connect.
EPSV	RFC 2428	Enter extended passive mode.
FEAT	RFC 2389	Get the feature list implemented by the server.
HELP		Returns usage documentation on a command if specified, else a general help document is returned.
HOST	RFC 7151	Identify desired virtual host on server, by name.
LANG	RFC 2640	Language Negotiation
LIST		Returns information of a file or directory if specified, else information of the current working directory is returned.
LPRT	RFC 1639	Specifies a long address and port to which the server should connect.
LPSV	RFC 1639	Enter long passive mode.
MDTM	RFC 3659	Return the last-modified time of a specified file.
MFCT	The 'MFMT', 'MFCT', and 'MFF' Command Extensions for FTP	Modify the creation time of a file.
MFF	The 'MFMT', 'MFCT', and 'MFF' Command Extensions for FTP	Modify fact (the last modification time, creation time, UNIX group/owner/mode of a file).
MFMT	The 'MFMT', 'MFCT', and 'MFF' Command Extensions for FTP	Modify the last modification time of a file.
MIC	RFC 2228	Integrity Protected Command
MKD		Make directory.
MLSD	RFC 3659	Lists the contents of a directory if a directory is named.
MLST	RFC 3659	Provides data about exactly the object named on its command line, and no others.
MODE		Sets the transfer mode (Stream, Block, or Compressed).
NLST		Returns a list of file names in a specified directory.
NOOP		No operation (dummy packet; used mostly on keepalives).
OPTS	RFC 2389	Select options for a feature (for example OPTS UTF8 ON).
PASS		Authentication password.
PASV		Enter passive mode.
PBSZ	RFC 2228	Protection Buffer Size
PORT		Specifies an address and port to which the server should connect.
PROT	RFC 2228	Data Channel Protection Level.
PWD		Print working directory. Returns the current directory of the host.
QUIT		Disconnect.
REIN		Re initializes the connection.
REST	RFC 3659	Restart transfer from the specified point.
RETR		Retrieve a copy of the file
RMD		Remove a directory.
RMDA	Streamlined FTP Command Extensions	Remove a directory tree
RNFR		Rename from.
RNTO		Rename to.
SITE		Sends site specific commands to remote server (like SITE IDLE 60 or SITE UMASK 002). Inspect SITE HELP output for complete list of supported commands.
SIZE	RFC 3659	Return the size of a file.
SMNT		Mount file structure.
SPSV	FTP Extension Allowing IP Forwarding (NATs)	Use single port passive mode (only one TCP port number for both control connections and passive-mode data connections)
STAT		Returns the current status.
STOR		Accept the data and to store the data as a file at the server site
STOU		Store file uniquely.
STRU		Set file transfer structure.
SYST		Return system type.
THMB	Streamlined FTP Command Extensions	Get a thumbnail of a remote image file
TYPE		Sets the transfer mode (ASCII/Binary).
USER		Authentication username.
XCUP	RFC 775	Change to the parent of the current working directory
XMKD	RFC 775	Make a directory
XPWD	RFC 775	Print the current working directory
XRCP	RFC 743
XRMD	RFC 775	Remove the directory
XRSQ	RFC 743
XSEM	RFC 737	Send, mail if cannot
XSEN	RFC 737	Send to terminal

6）ftp应答

ftp应答都是ASCII码形式的3位数字，并跟有报文选项。应答3位码中每一位数字都有不同的含义，这里就不详细列出（脑袋记不住）。直接拷贝Wikipedia的常见的应答码，如下：

Code	Explanation
100 Series	The requested action is being initiated, expect another reply before proceeding with a new command.
110	Restart marker replay . In this case, the text is exact and not left to the particular implementation; it must read: MARK yyyy = mmmm where yyyy is User-process data stream marker, and mmmm server's equivalent marker (note the spaces between markers and "=").
120	Service ready in nnn minutes.
125	Data connection already open; transfer starting.
150	File status okay; about to open data connection.
200 Series	The requested action has been successfully completed.
202	Command not implemented, superfluous at this site.
211	System status, or system help reply.
212	Directory status.
213	File status.
214	Help message. Explains how to use the server or the meaning of a particular non-standard command. This reply is useful only to the human user.
215	NAME system type. Where NAME is an official system name from the registry kept by IANA.
220	Service ready for new user.
221	Service closing control connection.
225	Data connection open; no transfer in progress.
226	Closing data connection. Requested file action successful (for example, file transfer or file abort).
227	Entering Passive Mode (h1,h2,h3,h4,p1,p2).
228	Entering Long Passive Mode (long address, port).
229	Entering Extended Passive Mode (|||port|).
230	User logged in, proceed. Logged out if appropriate.
231	User logged out; service terminated.
232	Logout command noted, will complete when transfer done.
234	Specifies that the server accepts the authentication mechanism specified by the client, and the exchange of security data is complete. A higher level nonstandard code created by Microsoft.
250	Requested file action okay, completed.
257	"PATHNAME" created.
300 Series	The command has been accepted, but the requested action is on hold, pending receipt of further information.
331	User name okay, need password.
332	Need account for login.
350	Requested file action pending further information
400 Series	The command was not accepted and the requested action did not take place, but the error condition is temporary and the action may be requested again.
421	Service not available, closing control connection. This may be a reply to any command if the service knows it must shut down.
425	Can't open data connection.
426	Connection closed; transfer aborted.
430	Invalid username or password
434	Requested host unavailable.
450	Requested file action not taken.
451	Requested action aborted. Local error in processing.
452	Requested action not taken. Insufficient storage space in system.File unavailable (e.g., file busy).
500 Series	Syntax error, command unrecognized and the requested action did not take place. This may include errors such as command line too long.
501	Syntax error in parameters or arguments.
502	Command not implemented.
503	Bad sequence of commands.
504	Command not implemented for that parameter.
530	Not logged in.
532	Need account for storing files.
534	Could Not Connect to Server - Policy Requires SSL
550	Requested action not taken. File unavailable (e.g., file not found, no access).
551	Requested action aborted. Page type unknown.
552	Requested file action aborted. Exceeded storage allocation (for current directory or dataset).
553	Requested action not taken. File name not allowed.
600 Series	Replies regarding confidentiality and integrity
631	Integrity protected reply.
632	Confidentiality and integrity protected reply.
633	Confidentiality protected reply.
10000 Series	Common Winsock Error Codes[2] (These are not FTP return codes)
10054	Connection reset by peer. The connection was forcibly closed by the remote host.
10060	Cannot connect to remote server.
10061	Cannot connect to remote server. The connection is actively refused by the server.
10066	Directory not empty.
10068	Too many users, server is full.

总结这么多，还是得抓包实际分析来看，下一节以实际抓包来分析ftp的整个连接过程。

 

参考：

《TCP/IP详解 卷1：协议》

https://wenku.baidu.com/view/fef7d6d658fb770bf68a55ae.html

https://en.wikipedia.org/wiki/List_of_FTP_commands

https://en.wikipedia.org/wiki/List_of_FTP_server_return_codes