How to get Full Path of source and destination in FTP Upload / Download through packet parsing?

Question

I am using WinPcap for packet capturing through c++ & FileZilla like agent to upload and download stuff.

Using FTP commands CWD, PWD, RETR.. etc from captured packets, I can get FTP path of Remote machine from which I am downloading or to which I am uploading my stuff. :)

But I am not able to get full path of document form which it is getting uploaded or to which it is getting download :(
I tried to parse all the packets going from my machine for full source path. I guess it is not there in any of the packets. Any suggestions?

Thanks in Advance..

Answer 1

FTP will typically use a relative path instead of the absolute path as seen on the filesystem. The server is simply not providing you with that information and there is nothing you can do about it.

Answer 2

If you captured the entire FTP session, you could infer the full path on the server (relative to the home directory of the FTP account) by looking at the pathnames in all the CWD commands, looking at any CDUP commands, and looking at the pathnames in the STOR and RETR commands. You'd have to scan the commands in order, keeping track of the server current directory by looking at CWD and CDUP commands, and combining that directory with the pathnames in the STOR and RETR commands.

You cannot, however, determine the path name on the client machine (your machine), as that's not sent on the network. You speak of "the full path of the document from which it is getting uploaded" and "... to which it is getting downloaded"; that sounds as if you want the path name on your machine. If so, that's inherently impossible to do by watching the FTP traffic.