In this section, we'll take a look at capturing some traffic for our troubleshooting scenario, and checking for some obvious issues before we look into the packet capture a bit more in-depth.
In the following screenshot, we have captured the traffic from the client connecting to the server:
We will now put a filter in here for port 21 because we know that the client is connecting over standard unencrypted FTP. For that we use tcp.port == 21:
So, we got rid of everything else. We can see that there are three packets, and it looks like we have a SYN and two retransmissions. So the client, which is .152, is trying to connect to the server running on .160, and it's not even beginning the TCP handshake. So the server is not doing something correctly in order to negotiate port 21. It's not that the server is rejecting the user credentials...
