I'm accessing my localhost ftp server by Iceweasel or by the terminal (with the command ftp) while listening on the ftp port with

sudo tcpdump -vv -A 'port 20'


sudo tcpdump -vv -A port ftp

but nothing is printed although the connection is well established.

What am I doing wrong?

  • 1
    Note that the FTP command TCP connections are on port 21 (ftp is 21) not 20. – Stéphane Chazelas Jun 7 '16 at 14:25
  • You may also have an ftp "passive" connection, meaning that your client will open a second connection to the server with high port numbers, contrary to an "active" ftp-connection where your client opens a control-channel to the client on port 21 and the server opens a connection to your client on port 20 for the data (which is not possible behind a firewall).. – gerhard d. Jun 7 '16 at 14:29

You indicated you are connecting via localhost. You will probably need to specify the interface with -i lo (or lo0 on a Mac), so use:

sudo tcpdump -i lo -vv -A port ftp

or on a Mac:

sudo tcpdump -i lo0 -vv -A port ftp

The you should see the traffic. The reason:

-i Listen on interface. If unspecified, tcpdump searches the system interface list for the lowest numbered, configured up interface (excluding loopback), which may turn out to be, for example, "eth0".

  • You may also want to add -n as hostname resolution can delay the printing. – Stéphane Chazelas Jun 7 '16 at 14:27
  • "or lo0 on a Mac" ...or on most other UN*Xes - Linux is the exception here. – user44841 Jun 7 '16 at 18:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.