> > i want to capture ftp download from a server to a client. what is the capture > filter to be used at both server and client so i can get only traffic from/to > port 20 and port 21? > > i tried this --> tcp port 20 and tcp port 21 but no traffic is captured. >
The correct syntax for what you thought of would be: tcp port 20 or tcp port 21 However, As the data port will often be negotiated (aka varies from transfer to transfer), you'll often won't be able to use a capture filter for this as you won't capture the data portion, see: http://wiki.wireshark.org/FTP Regards, ULFL _____________________________________________________________________ Der WEB.DE SmartSurfer hilft bis zu 70% Ihrer Onlinekosten zu sparen! http://smartsurfer.web.de/?mc=100071&distributionid=000000000066 _______________________________________________ Wireshark-users mailing list Wireshark-users@wireshark.org http://www.wireshark.org/mailman/listinfo/wireshark-users
