
Packet Filtering and Inspection ◾ 261
7.7.6.1 Step 1: Connect to the FTP Server Using the
Active FTP Mode and Sniff the Session Packets
From Host #1 and using LeapFTP, connect to the FTP server
of Host #2. By default, LeapFTP uses the Active FTP mode.
Then, using CommView sniffer at Host #1 or Host #2, capture
the session packets.
7.7.6.2 Step 2: Analyze the Active FTP Session Packets
The following screenshots show the detailed contents of the
main packets of the Command and Data sessions:
A. For the Command channel in the Active FTP session:
1. The first packet (SYN packet) of the three-way handshake
of the Command channel in the Active FT