> thomas wrote: > There is requirement to view the data transfer being done by any user > or application on port no 21 (i.e ftp port). Is there any option in > netstat that can show data is being transfered on port no 21 or data > transfer has been completed? > Any other way to track the same? You will need to record activity on ports 20 and 21. Port 20 is the "data channel" for ftp while port 21 is the "command channel".
Doesn't passive FTP complicate things a bit? http://slacksite.com/other/ftp.html In addition to tcpdump & ethereal, strace on the FTP server is another possibility.
