Troubleshooting Questions

1. How do I know if the FTP ALG is active?

• The ALG protocol field in the conversation should display ftp.
• There should be a valid frame count (Frm count) in the control flows.
• A valid frame count in the data flows indicates that data transfer has taken place.

2. What do I need to check if the FTP connection is established but data transfer does not take place?

• Most probably, the control connection is up, but the data connection is down.
• Check the conversations output to determine whether both the control and data flows are present.

3. How do I interpret each flow? What does each flow mean?

• FTP control flow initiator flow—flow with destination port 21
• FTP control flow responder flow—flow with source port 21
• FTP data flow initiator flow—flow with destination port 20
• FTP data flow responder flow—flow with source port 20