Monitor FTP traffic

[djeyewater]

Can anyone advise me on how I can intercept / monitor FTP traffic on
my computer?

I have followed the instructions at http://fiddler.wikidot.com/misc-information-page#toc1
(except the CaptureFTP property already existed, so I just changed its
value to True). I have restarted the computer, but Fiddler is still
not intercepting FTP requests made through Filezilla or my internet
browser (Google Chrome).

I'm using Windows 7 64 bit, and Fiddler is the latest version.

Thanks

Dave

[EricLaw]

I don't know anything about Filezilla.

Chrome appears to be buggy and ignores the system proxy setting for
the FTP protocol. It works fine in IE-based clients, and Firefox 4
properly attempts to proxy FTP if its proxy settings are configured
appropriately.

On Dec 5, 2:04 pm, djeyewater <showerhead...@hotmail.com> wrote:
> Can anyone advise me on how I can intercept / monitor FTP traffic on
> my computer?
>

> I have followed the instructions athttp://fiddler.wikidot.com/misc-information-page#toc1

[djeyewater]

Thanks for the info Eric. I tried accessing an FTP address in Internet
Explorer like you suggested, and Fiddler did intercept the connection
okay. So I guess Filezilla probably ignores the system proxy setting
for FTP like Chrome.

[Chad Sowald]

I use FileZilla for FTP too - it's great! I've never tried proxying
it, but I just loaded it up to find out. If you go to:

Edit --> Settings --> Connection --> Generic Proxy

you can set the proxy to Fiddler. HTTP 1.1 proxy, host = 127.0.0.1
and port = 8888 (by default)

The strange thing is that I did this and when I try to connect to a
site, I see the HTTP CONNECT in Fiddler, but it fails. Maybe someone
can explain the error message:

First, the raw HTTP CONNECT request:

CONNECT blahblah.host.com:21 HTTP/1.1
Host: blahblah.host.com:21
User-Agent: FileZilla

Now the raw response from that CONNECT:

HTTP/1.1 502 Connection failed
Connection: close
Timestamp: 10:27:31.243

HTTPS connection failed.

System.IO.IOException: The handshake failed due to an unexpected
packet format.
at System.Net.Security.SslState.StartReadFrame(Byte[] buffer,
Int32 readBytes, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer,
AsyncProtocolRequest asyncRequest)
at
System.Net.Security.SslState.CheckCompletionBeforeNextReceive(ProtocolToken
message, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.StartSendBlob(Byte[] incoming,
Int32 count, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.ForceAuthentication(Boolean
receiveFirst, Byte[] buffer, AsyncProtocolRequest asyncRequest)
at
System.Net.Security.SslState.ProcessAuthentication(LazyAsyncResult
lazyResult)
at System.Net.Security.SslStream.AuthenticateAsClient(String
targetHost, X509CertificateCollection clientCertificates, SslProtocols
enabledSslProtocols, Boolean checkCertificateRevocation)
at Fiddler.ServerPipe.WrapSocketInPipe(Session oS, Socket oSocket,
Boolean bSecureTheSocket, Boolean bCreateConnectTunnel, String
sCertCN, String sClientCertificateFilename, String sPoolingKey, Int32&
iHTTPSHandshakeTime)
at Fiddler.Session._handleHTTPSConnect()


I assume this means that FileZilla sent invalid data to Fiddler or did
something else go wrong? I'm using Fiddler 2.3.1.0 on Win XP and
FileZilla 3.3.5.1.

[EricLaw]

Yeah, that indicates that FileZilla is trying to create a tunnel
through the proxy instead of using the proxy as a HTTP->FTP gateway as
the CERN spec (and Fiddler) expect. They may offer some sort of option
to turn that off, but if they don't, I'm afraid you won't be able to
use Fiddler for this purpose.

> > > > Dave- Hide quoted text -
>
> - Show quoted text -

[Revamp Softvvare]

I guess if i can import fiddler private key to FileZilla then i can do this. But i have no idea how to convert the private key to ppk format.