Analysis

Control Flows

The control flows are established after the three-way handshake is complete.

• Control flow from FTP client to FTP server. TCP destination port is 21.

TCP           1.1.79.2:14083 ->        2.2.2.2:21    Watch    I              13

    NAT source        1.1.79.2:14083   ->   194.250.1.237:50118

• Control flow from FTP server to FTP client. TCP source port is 21.

TCP            2.2.2.2:21    ->  194.250.1.237:50118 Watch    O              12

    NAT dest     194.250.1.237:50118   ->        1.1.79.2:14083

Data Flows

A data port of 20 is negotiated for data transfer during the course of the FTP control protocol. These two flows are data flows between the FTP client and the FTP server:

TCP           1.1.79.2:14104 ->        2.2.2.2:20    Forward  I               3

    NAT source        1.1.79.2:14104   ->   194.250.1.237:50119

TCP            2.2.2.2:20    ->  194.250.1.237:50119 Forward  O               5

    NAT dest     194.250.1.237:50119   ->        1.1.79.2:14104