$ tshark -r ftp-server.pcap -n -Y 'ftp.request.command == "USER" || ftp.request.command == "PASS"' -T fields -e frame.number -e ip.src -e ftp.request.command -e ftp.request.arg 6 192.168.100.20 USER ftpdemo 9 192.168.100.20 PASS FtpIsPlaintext 77 192.168.100.20 USER ftpdemo 80 192.168.100.20 PASS FtpIsPlaintext 133 192.168.100.20 USER ftpdemo 136 192.168.100.20 PASS FtpIsPlaintext 189 192.168.100.20 USER ftpdemo 192 192.168.100.20 PASS FtpIsPlaintext 277 192.168.100.20 USER ftpdemo 292 192.168.100.20 USER ftpdemo $ tshark -r ubuntu-ftp-no9.pcap -n -x 0000 52 54 00 30 7e c3 52 54 00 78 56 37 08 00 45 10 RT.0~.RT.xV7..E. 0010 00 49 d0 db 40 00 40 06 20 54 c0 a8 64 14 c0 a8 .I..@.@. T..d... 0020 64 0a b8 84 00 15 af 9b d2 31 5a d4 22 ec 80 18 d........1Z."... 0030 00 fb e7 1e 00 00 01 01 08 0a 2d 4d d3 94 eb a6 ..........-M.... 0040 1a d8 50 41 53 53 20 46 74 70 49 73 50 6c 61 69 ..PASS FtpIsPlai 0050 6e 74 65 78 74 0d 0a ntext.. $ tshark -r ftp-server.pcap -n -Y 'frame.number >= 40 && frame.number <= 52' -T fields -e frame.number -e ip.src -e tcp.srcport -e ip.dst -e tcp.dstport -e _ws.col.info 40 192.168.100.20 47236 192.168.100.10 21 Request: EPSV 41 192.168.100.10 21 192.168.100.20 47236 Response: 229 Entering Extended Passive Mode (|||53233|) 42 192.168.100.20 60442 192.168.100.10 53233 60442 → 53233 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM TSval=2184570297 TSecr=0 WS=256 43 192.168.100.10 53233 192.168.100.20 60442 53233 → 60442 [SYN, ACK] Seq=0 Ack=1 Win=65160 Len=0 MSS=1460 SACK_PERM TSval=2456829945 TSecr=2184570297 WS=256 44 192.168.100.20 60442 192.168.100.10 53233 60442 → 53233 [ACK] Seq=1 Ack=1 Win=64256 Len=0 TSval=2184570299 TSecr=2456829945 45 192.168.100.20 47236 192.168.100.10 21 Request: RETR hello.txt 46 192.168.100.10 21 192.168.100.20 47236 Response: 150 Opening BINARY mode data connection for hello.txt (26 bytes). 47 192.168.100.10 53233 192.168.100.20 60442 FTP Data: 26 bytes (EPASV) (RETR hello.txt) 48 192.168.100.10 53233 192.168.100.20 60442 53233 → 60442 [FIN, ACK] Seq=27 Ack=1 Win=65280 Len=0 TSval=2456829947 TSecr=2184570299 49 192.168.100.20 60442 192.168.100.10 53233 60442 → 53233 [ACK] Seq=1 Ack=27 Win=64256 Len=0 TSval=2184570301 TSecr=2456829947 50 192.168.100.20 60442 192.168.100.10 53233 60442 → 53233 [FIN, ACK] Seq=1 Ack=28 Win=64256 Len=0 TSval=2184570302 TSecr=2456829947 51 192.168.100.10 53233 192.168.100.20 60442 53233 → 60442 [ACK] Seq=28 Ack=2 Win=65280 Len=0 TSval=2456829950 TSecr=2184570302 52 192.168.100.10 21 192.168.100.20 47236 Response: 226 Transfer complete. $ tshark -r ftp-server.pcap -n -Y 'ftp.response.code == 229' -T fields -e frame.number -e ftp.response.arg 23 Entering Extended Passive Mode (|||59134|) 41 Entering Extended Passive Mode (|||53233|) 57 Entering Extended Passive Mode (|||47977|) 94 Entering Extended Passive Mode (|||52014|) 110 Entering Extended Passive Mode (|||53689|) 150 Entering Extended Passive Mode (|||6067|) 166 Entering Extended Passive Mode (|||21507|) 206 Entering Extended Passive Mode (|||47435|) 224 Entering Extended Passive Mode (|||51762|) 236 Entering Extended Passive Mode (|||31305|) 252 Entering Extended Passive Mode (|||14734|) $ tshark -r ftp-server.pcap -n -Y 'frame contains "FtpIsPlaintext"' -T fields -e frame.number 9 80 136 192 $ tshark -r ubuntu-ftp-no346.pcap -n -x 0000 52 54 00 30 7e c3 52 54 00 78 56 37 08 00 45 00 RT.0~.RT.xV7..E. 0010 00 7e d6 cf 40 00 40 06 1a 3b c0 a8 64 14 c0 a8 .~..@.@..;..d... 0020 64 0a ab d0 5a c3 e3 d3 c3 78 be 6f 14 d9 80 18 d...Z....x.o.... 0030 00 fb 1f fb 00 00 01 01 08 0a db 9a d4 4d 67 1f .............Mg. 0040 1a ce 17 03 03 00 45 7d 26 01 1c 7d 16 17 0b 95 ......E}&..}.... 0050 1f 8b de fa fa e4 77 8e 2c 45 83 69 76 18 ef 4f ......w.,E.iv..O 0060 b5 d3 ac 11 c2 71 ec 56 a2 a1 c5 06 ce 27 d8 a8 .....q.V.....'.. 0070 8a b9 19 27 2d b6 28 27 dc c9 1f ad d0 28 c6 10 ...'-.('.....(.. 0080 37 c1 ef 9d 08 14 90 d4 30 00 73 6d 7.......0.sm $ tshark -r ftp-server.pcap -n -Y 'ftp.request.command == "AUTH" || ftp.response.code == 234' -T fields -e frame.number -e ip.src -e ftp.request.arg -e ftp.response.arg 303 192.168.100.20 SSL 305 192.168.100.10 Proceed with negotiation. 369 192.168.100.20 SSL 371 192.168.100.10 Proceed with negotiation.