Member Avatar for bigredaltoid

Hello everyone, not entirely sure if this is the right place to posts this, but here goes -

I recently started using Wireshark and am having some trouble with some of the basics. I need to do a packet trace of an SFTP and I am really confused as to how to get started with this.

Any help would be greatly appreciated, thanks in advance.

  • 3 Contributors
  • 5 Replies
  • 6K Views
  • 3 Days Discussion Span
  • Latest Post Latest Post by JorgeM

Dani AI

Generated

Quick sanity check: SFTP traffic will not appear as "SFTP" in Wireshark. SFTP runs inside SSH, so you will usually see it as SSH on TCP port 22. Because SSH is encrypted, you cannot decode file names or contents; you can only analyze metadata (IPs, ports, timings, sizes, retransmissions).

Practical workflow:

  1. Start a targeted capture, then initiate the SFTP transfer so the packets are actually generated during capture.

Capture filter examples (keeps the file small):

tcp port 22
tcp port 22 and host <server_ip>

Display filter examples (after the capture):

ssh
ssh and ip.addr == <server_ip>
tcp.port == 22 and ip.addr == <server_ip>

Use Follow TCP Stream to confirm you are on the right flow (it will be binary). Check Statistics > Conversations and TCP analysis flags to troubleshoot slowness or loss.

If you still see nothing:

  • You may be using FTPS (FTP over TLS) instead of SFTP. FTPS appears as TLS, often on ports 21 (explicit) or 990 (implicit). Try a display filter of tls or filter by the server IP and control port.
  • The server may use a nonstandard SSH port; filter by the server IP rather than port.
  • You are not capturing on the right path. On switched networks you must capture on an endpoint, a SPAN/mirror port, or a TAP.

References: Wireshark SSH filter reference at wireshark.org/docs/dfref/s/ssh.html, capture filters in the User Guide at wireshark.org/docs/wsug_html_chunked/ChCapCaptureFilterSection.html, and capture setup guidance at wiki.wireshark.org/CaptureSetup/Ethernet.

Recommended Answers

All 5 Replies

Member Avatar for L7Sqr

Wireshark will allow you capture on an interface. Just start the program with no arguments and select the interface you want to capture on. Once you are capturing packets you can set a filter to limit those packets that you are viewing. From there, you can save just the selected packets.
These steps allow you to capture just an SFTP stream if you set the filter correctly.

Member Avatar for bigredaltoid

Maybe I am just not understanding how Wireshark works entirely. I understand how to capture the packets in an interface, but I can't seem to find any SFTP packets.

Member Avatar for JorgeM

Wireshark, as with other packet capturing apps, will allow you to capture the packets that are picked up by the interface, or in promiscuous mode it will see all traffic that comes accross the interface including packets the interface doesnt bring up through the stack.

If you dont have any capture filters configured, you can create a display filter after you capture the packets and your display filter can be based upon protocol, ip info, ports, etc...

You'd have to take a look at their documentation on how to create the appropriate display filter. Be patient with Wireshark as it takes time to learn how to use it.

Member Avatar for bigredaltoid

So if I wanted to capture an SFTP stream, I would need to do something on my computer that would utilize SFTP and than have wireshark running during the process?

Member Avatar for JorgeM

Assuming the SFTP service is on another computer, yes, if you have Wireshark running and you attempt an SFTP connection, you should see the packets captured.

Edited by JorgeM
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.