Capture ftp hostname and uri using tshark (wireshark) - ftp

Question

I want to watch the ftp traffic and find which ftp urls are being accessed with tshark. For http traffic I can use
tshark -i eth0 -f 'port 80' -l -t ad -n -R 'http.request' -T fields -e http.host -e http.request.uri
Wireshark's Display Filters contains the fields http.request.uri and http.host
See: http://www.wireshark.org/docs/dfref/h/http.html
But these options are not available for ftp traffic.
http://www.wireshark.org/docs/dfref/f/ftp.html
What can I do?

Answer 1

The problem is that FTP is not a stateless transactional protocol like HTTP - with HTTP the client does a single request which details all the parameters required to deliver the file, and the server responds with a single message that contains all the metadata and the file contents.
In comparison, FTP is a chat-style protocol: to get something done you open a connection to the server and starts chatting with the server - login, change to some directory, list files, get me this file, etc.
You can listen into this conversation using wireshark like this:
tshark -i lo -f 'port 21' -l -t ad -n -R ftp.request.command -T fields -e ftp.request.command -e ftp.request.arg
The output received when a user tries to retrieve a file from the FTP server (in this example using the client software curl) might look like this:
USER username
PASS password
PWD
CWD Documents
EPSV
TYPE I
SIZE somefile.ext
RETR somefile.ext
QUIT
A bit of processing over that might give you a URL like log of file retrievals. For example, I came up with this thing using perl:
tshark -i lo -f 'port 21' -l -t ad -n -R ftp.request.command \
-T fields -e ftp.request.command -e ftp.request.arg | \
perl -nle '
m|CWD\s*(\S+)| and do {
$dir=$1;
if ($dir =~ m,^/,) { $cwd=$dir } else { $cwd .= "/$dir"; }
};
m|RETR\s*(\S+)| and print "$cwd/$1";'
For the same FTP session above, this script will yield a single line of output:
/Documents/somefile.ext
I hope that helps.