Wireshark之FTP协议分析（一）
最近项目需求，需要抓取并还原网络中通过ftp传输的文件。故对ftp协议进行了简单学习，总结如下。
1. ftp协议概述
这部分内容我参考的百度文库的一篇文档：
https://wenku.baidu.com/view/fef7d6d658fb770bf68a55ae.html
里面讲的很详细。在此对重点的部分进行总结一下。
1）ftp服务端的用到两个端口20和21。
2）FTP使用不同的端口号传输不同的内容，会建立不同的TCP连接。首先，使用 TCP 生成一个虚拟连接用于控制信息，然后再生成一个单独的 TCP 连接用于数据传输。
3）FTP有两种工作模式，分别是主动模式(PORT)和被动模式(PASV)两种模式，这两种模式是按照FTP服务器的“角度”来说的，更通俗一点说就是：在传输数据时，如果是服务器主动连接客户端，那就是主动模式；如果是客户端主动连接服务器，那就是被动模式。主动模式下，服务端采用端口20做数据连接。
4）目前ftp客户端与服务端的 传输方式为流方式，传输类型为ASCII或是二进制，传输结构为文件结构（文件被认为一个连续的字节流）。
5）ftp命令
ftp命令和应答在客户和服务端的控制连接上以NVT ASCII码（百度了解）形式传输。
从客户发送给服务端的ftp命令超过30种，这些命令都是3或4个字节的大写ASCII字符，其中一些带选项参数。我从Wikipedia中拷贝过来如下：
| Command | RFC | Description |
|---|---|---|
| ABOR | Abort an active file transfer. | |
| ACCT | Account information. | |
| ADAT | RFC 2228 | Authentication/Security Data |
| ALLO | Allocate sufficient disk space to receive a file. | |
| APPE | Append (with create) | |
| AUTH | RFC 2228 | Authentication/Security Mechanism |
| AVBL | Streamlined FTP Command Extensions | Get the available space |
| CCC | RFC 2228 | Clear Command Channel |
| CDUP | Change to Parent Directory. | |
| CONF | RFC 2228 | Confidentiality Protection Command |
| CSID | Streamlined FTP Command Extensions | Client / Server Identification |
| CWD | RFC 697 | Change working directory. |
| DELE | Delete file. | |
| DSIZ | Streamlined FTP Command Extensions | Get the directory size |
| ENC | RFC 2228 | Privacy Protected Channel |
| EPRT | RFC 2428 | Specifies an extended address and port to which the server should connect. |
| EPSV | RFC 2428 | Enter extended passive mode. |
| FEAT | RFC 2389 | Get the feature list implemented by the server. |
| HELP | Returns usage documentation on a command if specified, else a general help document is returned. | |
| HOST | RFC 7151 | Identify desired virtual host on server, by name. |
| LANG | RFC 2640 | Language Negotiation |
| LIST | Returns information of a file or directory if specified, else information of the current working directory is returned. | |
| LPRT | RFC 1639 | Specifies a long address and port to which the server should connect. |
| LPSV | RFC 1639 | Enter long passive mode. |
| MDTM | RFC 3659 | Return the last-modified time of a specified file. |
| MFCT | The 'MFMT', 'MFCT', and 'MFF' Command Extensions for FTP | Modify the creation time of a file. |
| MFF | The 'MFMT', 'MFCT', and 'MFF' Command Extensions for FTP | Modify fact (the last modification time, creation time, UNIX group/owner/mode of a file). |
| MFMT | The 'MFMT', 'MFCT', and 'MFF' Command Extensions for FTP | Modify the last modification time of a file. |
| MIC | RFC 2228 | Integrity Protected Command |
| MKD | Make directory. | |
| MLSD | RFC 3659 | Lists the contents of a directory if a directory is named. |
| MLST | RFC 3659 | Provides data about exactly the object named on its command line, and no others. |
| MODE | Sets the transfer mode (Stream, Block, or Compressed). | |
| NLST | Returns a list of file names in a specified directory. | |
| NOOP | No operation (dummy packet; used mostly on keepalives). | |
| OPTS | RFC 2389 | Select options for a feature (for example OPTS UTF8 ON). |
| PASS | Authentication password. | |
| PASV | Enter passive mode. | |
| PBSZ | RFC 2228 | Protection Buffer Size |
| PORT | Specifies an address and port to which the server should connect. | |
| PROT | RFC 2228 | Data Channel Protection Level. |
| PWD | Print working directory. Returns the current directory of the host. | |
| QUIT | Disconnect. | |
| REIN | Re initializes the connection. | |
| REST | RFC 3659 | Restart transfer from the specified point. |
| RETR | Retrieve a copy of the file | |
| RMD | Remove a directory. | |
| RMDA | Streamlined FTP Command Extensions | Remove a directory tree |
| RNFR | Rename from. | |
| RNTO | Rename to. | |
| SITE | Sends site specific commands to remote server (like SITE IDLE 60 or SITE UMASK 002). Inspect SITE HELP output for complete list of supported commands. |
|
| SIZE | RFC 3659 | Return the size of a file. |
| SMNT | Mount file structure. | |
| SPSV | FTP Extension Allowing IP Forwarding (NATs) | Use single port passive mode (only one TCP port number for both control connections and passive-mode data connections) |
| STAT | Returns the current status. | |
| STOR | Accept the data and to store the data as a file at the server site | |
| STOU | Store file uniquely. | |
| STRU | Set file transfer structure. | |
| SYST | Return system type. | |
| THMB | Streamlined FTP Command Extensions | Get a thumbnail of a remote image file |
| TYPE | Sets the transfer mode (ASCII/Binary). | |
| USER | Authentication username. | |
| XCUP | RFC 775 | Change to the parent of the current working directory |
| XMKD | RFC 775 | Make a directory |
| XPWD | RFC 775 | Print the current working directory |
| XRCP | RFC 743 | |
| XRMD | RFC 775 | Remove the directory |
| XRSQ | RFC 743 | |
| XSEM | RFC 737 | Send, mail if cannot |
| XSEN | RFC 737 | Send to terminal |
6）ftp应答
ftp应答都是ASCII码形式的3位数字，并跟有报文选项。应答3位码中每一位数字都有不同的含义，这里就不详细列出（脑袋记不住）。直接拷贝Wikipedia的常见的应答码，如下：
| Code | Explanation |
|---|---|
100 Series |
The requested action is being initiated, expect another reply before proceeding with a new command. |
110 |
Restart marker replay . In this case, the text is exact and not left to the particular implementation; it must read: MARK yyyy = mmmm where yyyy is User-process data stream marker, and mmmm server's equivalent marker (note the spaces between markers and "="). |
120 |
Service ready in nnn minutes. |
125 |
Data connection already open; transfer starting. |
150 |
File status okay; about to open data connection. |
200 Series |
The requested action has been successfully completed. |
202 |
Command not implemented, superfluous at this site. |
211 |
System status, or system help reply. |
212 |
Directory status. |
213 |
File status. |
214 |
Help message. Explains how to use the server or the meaning of a particular non-standard command. This reply is useful only to the human user. |
215 |
NAME system type. Where NAME is an official system name from the registry kept by IANA. |
220 |
Service ready for new user. |
221 |
Service closing control connection. |
225 |
Data connection open; no transfer in progress. |
226 |
Closing data connection. Requested file action successful (for example, file transfer or file abort). |
227 |
Entering Passive Mode (h1,h2,h3,h4,p1,p2). |
228 |
Entering Long Passive Mode (long address, port). |
229 |
Entering Extended Passive Mode (|||port|). |
230 |
User logged in, proceed. Logged out if appropriate. |
231 |
User logged out; service terminated. |
232 |
Logout command noted, will complete when transfer done. |
234 |
Specifies that the server accepts the authentication mechanism specified by the client, and the exchange of security data is complete. A higher level nonstandard code created by Microsoft. |
250 |
Requested file action okay, completed. |
257 |
"PATHNAME" created. |
300 Series |
The command has been accepted, but the requested action is on hold, pending receipt of further information. |
331 |
User name okay, need password. |
332 |
Need account for login. |
350 |
Requested file action pending further information |
400 Series |
The command was not accepted and the requested action did not take place, but the error condition is temporary and the action may be requested again. |
421 |
Service not available, closing control connection. This may be a reply to any command if the service knows it must shut down. |
425 |
Can't open data connection. |
426 |
Connection closed; transfer aborted. |
430 |
Invalid username or password |
434 |
Requested host unavailable. |
450 |
Requested file action not taken. |
451 |
Requested action aborted. Local error in processing. |
452 |
Requested action not taken. Insufficient storage space in system.File unavailable (e.g., file busy). |
500 Series |
Syntax error, command unrecognized and the requested action did not take place. This may include errors such as command line too long. |
501 |
Syntax error in parameters or arguments. |
502 |
Command not implemented. |
503 |
Bad sequence of commands. |
504 |
Command not implemented for that parameter. |
530 |
Not logged in. |
532 |
Need account for storing files. |
534 |
Could Not Connect to Server - Policy Requires SSL |
550 |
Requested action not taken. File unavailable (e.g., file not found, no access). |
551 |
Requested action aborted. Page type unknown. |
552 |
Requested file action aborted. Exceeded storage allocation (for current directory or dataset). |
553 |
Requested action not taken. File name not allowed. |
600 Series |
Replies regarding confidentiality and integrity |
631 |
Integrity protected reply. |
632 |
Confidentiality and integrity protected reply. |
633 |
Confidentiality protected reply. |
10000 Series |
Common Winsock Error Codes[2] (These are not FTP return codes) |
10054 |
Connection reset by peer. The connection was forcibly closed by the remote host. |
10060 |
Cannot connect to remote server. |
10061 |
Cannot connect to remote server. The connection is actively refused by the server. |
10066 |
Directory not empty. |
10068 |
Too many users, server is full. |
总结这么多，还是得抓包实际分析来看，下一节以实际抓包来分析ftp的整个连接过程。
参考：
《TCP/IP详解 卷1：协议》
https://wenku.baidu.com/view/fef7d6d658fb770bf68a55ae.html
https://en.wikipedia.org/wiki/List_of_FTP_commands
https://en.wikipedia.org/wiki/List_of_FTP_server_return_codes