Cant find text content in wireshark

[Soumyadip]

I transferred file with out encryption from filezilla to QBox and captured the packets. I opened that pcap file but could not find text content of the file.
@amanagar, @chandra-kiran_crio

[amanagar]

Hey @Soumyadip check this out you will find out you have to analyze .pcap file in wireshark

Analyzing Different Authentication Methods with Wireshark

[nabhanpv]

@Soumyadip

• As mentioned here by @Kiran, Wireshark populate it’s Protocol column by inferring from the port number

Cannot see FTP inside pcap file

Good question but this is what you are learning. Wireshark can only differentiate packets as ftp if they are using the standard port of 21 for ftp. In our case, we wouldn’t see the packets resolved to ftp. Hint: Try to filter based on the ports you are using. Spend some time figuring this out. Don’t just say something is a problem because you cannot explain it.

• Now, if want Wireshark to show FTP corresponding to our FTP packets, we need to tell it manually which all ports we are using for FTP manually.

• How to do it?

  1. For each of the port number we want to assign as FTP, Right-Click and click on Decode As
  2. Click on + icon to add a new entry. Double-click on (none) to open the drop-down and select the required protocol from it.
  3. Click Ok

• You’ll see the text we usually see logged into vsftpd.conf in the Info column for packets having data

Hope it helped