DNS Port 53

FTP Server Port 20 Port 21 1030

FTP Client 1175 5001 5002

Console User

This sequence diagram was generated with EventStudio System Designer (http://www.EventHelix.com/EventStudio). Here we explore the sequence of interactions in a typical FTP (File Transfer Protocol) session. The example here illustrates the use of multiple TCP connections by FTP. We will cover how FTP establishes a telnet TCP connection (TCP Port 21) to control the overall flow of the FTP transfer. Then we examine the use of TCP Port 20 for establishing TCP connections for directory transfer and file retrieval. The complete sequence diagram can be divided into the following steps: - DNS Query to obtain the IP address for the FTP Server - FTP Telnet connection setup and login. (USER and PASS commands) - Obtaining a directory listing (PORT and LIST command) - Changing directory (CWD command) - Downloading a file using FTP get (PORT and RETR command) Copyright 2013 EventHelix.com Inc. All Rights Reserved. DNS Query to obtain the IP address for the FTP Server.
Invoke FTP client with ftp.any-domain.c om

DNS Query
recdesired = 1, queries = 1, name = ftp.any-domain.com, type = A, class = IN

The FTP client sends a DNS query for domain name ftp.any-domain.com The DNS responds back with the IP address.

DNS Response
recdesired = 1, answers = 1, IP Address

FTP Telnet connection setup and login. (USER and PASS commands). TCP connection establishment over the control port TCP SYN
srcport = 1175, dstport = 21, syn = 1

FTP client initiates establishment of the telnet session TCP connection by sending a SYN to TCP port 21 The FTP server responds with SYN+ACK The client machine responds with an ACK, this completes the TCP three way handshake.

TCP SYN+ACK
srcport = 21, dstport = 1175, syn = 1, ack = 1

TCP ACK
srcport = 1175, dstport = 21, ack = 1

Logging in Display login prompt and get user name FTP 220
ftp.response.code = 220, ftp.response.arg = ANY-DOMAIN.COM FTP Service

The FTP server then sends a 220 response to indicate that the FTP server is ready to accept a login.

Display welcome message TCP ACK

srcport = 1175, dstport = 21, ack = 1

The client machine acknowledges the FTP 220 TCP packet. Enter login information

DNS Port 53

FTP Server Port 20 Port 21 1030 USER ftp

FTP Client 1175 5001 5002

Console User User's login name is transported in a TCP segment. In this example an anonymous FTP is being initiated with the user name "ftp"

TCP ACK
srcport = 21, dstport = 1175, ack = 1

FTP 331
code = 331, arg = Anonymous access allowed, send identity (e-mail name) as password.

FTP server indicates that anonymous FTP is allowed.

Display password prompt and complete login Password prompt TCP ACK
srcport = 1175, dstport = 21, ack = 1

Password information PASS abc@any-domain.com User enters his or her e-mail address as the password. This password is being transported by this TCP segment.

TCP ACK
srcport = 21, dstport = 1175, ack = 1

FTP 230
code = 230, arg = Welcome to ftp.any-domain.com

Welcome message after login.

FTP 230
code = 230, arg = Anonymous user logged in.

User login notification.

Login successful prompt TCP ACK

srcport = 1175, dstport = 21, ack = 1

Obtaining a directory listing (PORT and LIST command). User requests directory listing dir command PORT 192.168.0.2 Port 5001 TCP ACK
srcport = 21, dstport = 1175, ack = 1

FTP client provides port number information.

FTP 200
code = 200, arg = PORT command successful.

FTP server positively acknowledges the PORT command. User requests a directory listing.

LIST seq-251
srcport = 21, dstport = 1175, ack = 1

DNS Port 53

FTP Server Port 20 Port 21 1030 FTP 150

FTP Client 1175 5001 5002

Console User FTP server notifies the client that it is about to transfer the requested listing.

ftp.response.code = 150, ftp.response.arg = Opening ASCII mode data connection for /bin/ls.

Establish data port connection to transfer directory listing TCP SYN

srcport = 20, dstport = 5001, syn = 1

TCP three way handshake for connection establishment on port 5001.

TCP SYN+ACK
srcport = 5001, dstport = 20, syn = 1, ack = 1

TCP ACK
srcport = 20, dstport = 5001, ack = 1

Display directory listing FTP 226

ftp.response.code = 226, ftp.response.arg = Transfer complete.

The directory listing completion is signaled by this TCP segment.

TCP ACK
srcport = 1175, dstport = 21, ack = 1

TCP ACK
srcport = 20, dstport = 5001, ack = 1

Display directory listing

Release the data port TCP connection on completion of the directory listing TCP FIN+ACK
tcp.srcport = 20, tcp.dstport = 5001, tcp.flags.ack = 1, tcp.flags.fin = 1

FTP server initiates the release of the TCP connection used to transport the directory listing.

TCP ACK
tcp.srcport = 5001, tcp.dstport = 20, tcp.flags.ack = 1

TCP FIN+ACK
tcp.srcport = 5001, tcp.dstport = 20, tcp.flags.ack = 1, tcp.flags.fin = 1

TCP ACK
tcp.srcport = 20, tcp.dstport = 5001, tcp.flags.ack = 1

Changing directory (CWD command). Change working directory (cwd) CWD <directory-name> TCP ACK
tcp.srcport = 21, tcp.dstport = 1175, tcp.flags.ack = 1

User issues the change working directory command.

250 CWD Successful

code = 250, arg = CWD command successful.

FTP server positively acknowledges the Change Working Directory command.

DNS Port 53

FTP Server Port 20 Port 21 1030 TCP ACK

FTP Client 1175 5001 5002

Console User

tcp.srcport = 1175, tcp.dstport = 21, ack = 1

Downloading a file using FTP get (PORT and RETR command). Requesting file over the TCP control port FTP get for readme.txt PORT 192.168.0.2 Port 5002 TCP ACK
tcp.srcport = 21, tcp.dstport = 1175, ack = 1

FTP client provides port number information.

PORT 192.168.0.2 Port 5002 RETR readme.txt TCP ACK

tcp.srcport = 21, tcp.dstport = 1175, ack = 1

FTP client provides port number information. The user issues an FTP get for readme.txt.

FTP 150
code = 150, arg = Opening ASCII mode data connection for readme.txt(1715 bytes).

FTP server acknowledges the RETR command from the client.

Setting up the data TCP connection (3 way handshake) TCP SYN

tcp.srcport = 20, tcp.dstport = 5002, syn = 1, ack = 0, fin = 0

Three way handshake for TCP connection on Port 5002.

TCP SYN+ACK
tcp.srcport = 5002, tcp.dstport = 20, syn = 1, ack = 1

TCP ACK
tcp.srcport = 20, tcp.dstport = 5002, ack = 1

Transfering the file over the data TCP connection FTP DATA
tcp.srcport = 20, tcp.dstport = 5002, ack = 1

TCP segments carrying contents of readme.txt.

FTP DATA
tcp.srcport = 20, tcp.dstport = 5002, ack = 1

TCP ACK
tcp.srcport = 5002, tcp.dstport = 20, ack = 1

FTP DATA
tcp.srcport = 20, tcp.dstport = 5002, ack = 1

TCP segments carrying contents of readme.txt.

FTP DATA
tcp.srcport = 20, tcp.dstport = 5002, ack = 1

TCP ACK
tcp.srcport = 5002, tcp.dstport = 20, ack = 1

Releasing the data TCP connection

DNS Port 53

FTP Server Port 20 Port 21 1030

FTP Client 1175 5001 5002

Console User This is the last TCP segment containing data, it also includes the FIN to initiate the release of the TCP connection.

FTP DATA+FIN
tcp.srcport = 20, tcp.dstport = 5002, ack = 1, fin = 1

TCP ACK
tcp.srcport = 5002, tcp.dstport = 20, ack = 1

TCP FIN+ACK
tcp.srcport = 5002, tcp.dstport = 20, ack = 1, fin = 1

FTP client also initiates the release of the TCP connection.

TCP ACK
tcp.srcport = 20, tcp.dstport = 5002, ack = 1

Signal completion of the FTP over the control port TCP ACK
tcp.srcport = 1175, tcp.dstport = 21, ack = 1

FTP 226
code = 226, arg = Transfer complete.

Signal to the client that the FTP transfer has been completed.

Display transfer complete indication TCP ACK

tcp.srcport = 1175, tcp.dstport = 21, ack = 1

Logging out Quitting the FTP client Exit FTP client using bye command QUIT
ftp.request.command = QUIT

User initiates a "bye" on the FTP client console. This is translated to the quit command.

TCP ACK
tcp.srcport = 21, tcp.dstport = 1175, ack = 1

FTP 221
code = 221, arg = Thank you for visiting ftp.any-domain.com.

TCP ACK
tcp.srcport = 1175, tcp.dstport = 21, ack = 1

Releasing the control TCP connection TCP FIN

tcp.srcport = 21, tcp.dstport = 1175, ack = 1, fin = 1

Control TCP connection release initiated.

TCP ACK
tcp.srcport = 1175, tcp.dstport = 21, ack = 1, fin = 1

TCP FIN
tcp.srcport = 1175, tcp.dstport = 21, ack = 1, fin = 1

Control TCP connection release is completed.

TCP ACK
tcp.srcport = 21, tcp.dstport = 1175, ack = 1, fin = 1

DNS Port 53

FTP Server Port 20 Port 21 1030

FTP Client 1175 5001 5002

Console User

This sequence diagram was generated with EventStudio System Designer (http://www.EventHelix.com/EventStudio).