CCNA Cisco Certified Network Associate Study Guide - FTP Server

TCP/IP and the DoD Model 115
addresses to understand the sending host’s address like the Data Link and Network
layer protocols do. Instead, they use port numbers. It’s easy to imagine
the receiving host getting confused if all the hosts used the same port number
to get to FTP.
TCP Session: Destination Port
Now, typically you’ll look at an analyzer and see that only the source port
is above 1024 and the destination port is a well-known port, as shown in the
following Etherpeek trace:
TCP - Transport Control Protocol
Source Port: 1144
Destination Port: 80 World Wide Web HTTP
Sequence Number: 9356570
Ack Number: 0
Offset: 7
Reserved: %000000
Code: %000010
Synch Sequence
Window: 8192
Checksum: 0x57E7
Urgent Pointer: 0
TCP Options:
Option Type: 2 Maximum Segment Size
Length: 4
MSS: 536
Option Type: 1 No Operation
Option Type: 1 No Operation
Option Type: 4
Length: 2
Opt Value:
No More HTTP Data
Frame Check Sequence: 0x43697363
Notice that the source port is over 1024, but the destination port is 80, or
HTTP service. The server, or receiving host, will change the destination port
if it needs to.