萬花筒寫輪眼之防火牆ALG技術之FTP協議穿牆術

{"type":"doc","content":[{"type":"heading","attrs":{"align":null,"level":2},"content":[{"type":"text","text":"FTP協議主動模式穿越SNAT","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"主動模式穿越SNAT主要用於FTP服務器部署在公網，客戶端需要通過SNAT轉換訪問服務器。如圖1-1所示，描述了FTP主動模式穿越SNAT時的工作流程，此時需要藉助ALG技術纔可以完成穿越防火牆。","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"image","attrs":{"src":"https://static001.geekbang.org/infoq/eb/eb8f3f18e665b5c8a25d1bce7042b2f6.png","alt":"防火牆ALG技術之FTP協議穿牆術","title":null,"style":[{"key":"width","value":"75%"},{"key":"bordertype","value":"none"}],"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"圖1-1 FTP主動模式穿越SNAT流程圖","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"防火牆設備上配置了私網地址192.168.12.2到公網地址106.120.22.2/FTP服務的映射，實現IP地址的轉換，以支持私網客戶端對公網服務器的訪問。組網中，若沒有ALG對報文載荷的處理（圖1-1中紅色字體部分內容的變化），私網客戶端發送的PORT報文到達公網服務器端後，服務器無法根據私網地址進行路由，也就無法正常地建立數據連接，從而導致私網客戶端訪問公網FTP服務器失敗。如圖1-2-(a)和圖1-2-(b)所示，整個通信過程包括以下幾個階段：","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"bulletedlist","content":[{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"私網客戶端與公網服務器之間TCP的三次握手建立控制連接；","attrs":{}}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"私網客戶端發送PORT命令，攜帶私網客戶端指定的用於數據連接的IP和PORT信息；","attrs":{}}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"PORT命令到達防火牆時，報文載荷中的私網IP（192.168.12.2）和PORT（Y=31272=122*256+40）會被轉換成爲公網IP（106.120.22.2）和PORT（Y'=31272=122*256+40）；","attrs":{}}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"公網服務器收到PORT命令後解析其內容，並主動向私網客戶端發送數據連接（源IP-106.120.12.2、目的IP-106.120.22.2、源端口-20、目的端口-Y'=31272），經防火牆NAT轉換後（源IP-106.120.12.2、目的IP-192.168.12.2、源端口-20、目的端口Y=31272）發送至公網服務器，從而實現私網客戶端訪問公網服務器。","attrs":{}}]}]}],"attrs":{}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"image","attrs":{"src":"https://static001.geekbang.org/infoq/1e/1ef104c081da5695cbf9616bf5825a83.png","alt":"防火牆ALG技術之FTP協議穿牆術","title":null,"style":[{"key":"width","value":"75%"},{"key":"bordertype","value":"none"}],"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"圖1-2-(a) FTP主動模式穿越SNAT-Client","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"image","attrs":{"src":"https://static001.geekbang.org/infoq/17/173ffe2904b26a9f08b9dcd0c6968e25.png","alt":"防火牆ALG技術之FTP協議穿牆術","title":null,"style":[{"key":"width","value":"75%"},{"key":"bordertype","value":"none"}],"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"圖1-2-(b) FTP主動模式穿越SNAT-Server","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"heading","attrs":{"align":null,"level":2},"content":[{"type":"text","text":"FTP協議被動模式穿越SNAT","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"被動模式穿越SNAT主要用於FTP服務器部署在公網，客戶端需要通過SNAT轉換訪問服務器。如圖2-1所示，描述了FTP被動模式穿越SNAT時的工作流程，此時不需要藉助ALG技術也可以完成穿越防火牆的（爲什麼呢？請思考一下）。","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"image","attrs":{"src":"https://static001.geekbang.org/infoq/e9/e923076fda7ac8b0641b59cfe7840a46.png","alt":"防火牆ALG技術之FTP協議穿牆術","title":null,"style":[{"key":"width","value":"75%"},{"key":"bordertype","value":"none"}],"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"圖2-1 FTP被動模式穿越SNAT流程圖","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"如圖2-2-(a)和2-2-(b)所示，防火牆配置同“1.FTP協議主動模式穿越SNAT”章節所述，整個通信過程包括以下幾個階段：","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"bulletedlist","content":[{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"私網客戶端與公網服務器之間TCP的三次握手建立控制連接；","attrs":{}}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"私網客戶端發送PASV命令，公網服務器響應PASV命令，攜帶公網服務器指定的用於數據連接的IP和PORT信息，被動地等待客戶端來連接；","attrs":{}}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"PASV響應命令到達防火牆時，報文載荷中的公網IP（106.120.12.2）和PORT（Z=23076=90*256+36）不會進行NAT轉換，將原樣轉發至私網客戶端；","attrs":{}}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"私網客戶端收到PASV響應命令後解析其內容，發送數據連接（源IP-192.168.12.2、目的IP-106.120.12.2、源端口-Y=31277、目的端口- Z=23076），經防火牆NAT轉換後（源IP-106.120.22.2、目的IP-106.120.12.2、源端口-Y'=10009、目的端口Z=23076）發送至公網服務器，從而實現私網客戶端訪問公網服務器。","attrs":{}}]}]}],"attrs":{}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"圖2-2-(a) FTP被動模式穿越SNAT-Client","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"image","attrs":{"src":"https://static001.geekbang.org/infoq/4c/4c85bbe1d52bd58cda3a38933c2be1bc.png","alt":"防火牆ALG技術之FTP協議穿牆術","title":null,"style":[{"key":"width","value":"75%"},{"key":"bordertype","value":"none"}],"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"圖2-2-(b) FTP被動模式穿越SNAT-Server","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"image","attrs":{"src":"https://static001.geekbang.org/infoq/4c/4c85bbe1d52bd58cda3a38933c2be1bc.png","alt":"防火牆ALG技術之FTP協議穿牆術","title":null,"style":[{"key":"width","value":"75%"},{"key":"bordertype","value":"none"}],"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"heading","attrs":{"align":null,"level":2},"content":[{"type":"text","text":"FTP協議被動模式穿越DNAT","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"被動模式穿越DNAT主要用於FTP服務器部署在私網，客戶端需要通過DNAT轉換訪問服務器，如圖3-1所示，描述了FTP被動模式穿越DNAT時的工作流程，此時需要藉助ALG技術纔可以完成穿越防火牆。","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"image","attrs":{"src":"https://static001.geekbang.org/infoq/83/834ad371a194019b2fc991ad71bfa23e.png","alt":"防火牆ALG技術之FTP協議穿牆術","title":null,"style":[{"key":"width","value":"75%"},{"key":"bordertype","value":"none"}],"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"圖3-1 FTP被動模式穿越DNAT流程圖","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"防火牆設備上配置了私網地址192.168.12.2/TCP私網端口21到公網地址106.120.22.2/TCP公網端口2100的映射，實現IP地址的轉換，以支持公網客戶端對私網服務器的訪問。組網中，若沒有ALG對報文載荷的處理（圖3-1中紅色字體部分內容的變化），私網服務器發送的PASV響應報文到達公網客戶端後，客戶端無法根據私網地址進行路由，也就無法建立正確的數據連接。如圖3-2-(a)和圖3-2-(b)所示，整個通信過程包括以下幾個階段：","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"bulletedlist","content":[{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"公網客戶端與私網服務器之間TCP的三次握手建立控制連接；","attrs":{}}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"公網客戶端發送PASV命令，私網服務器響應PASV命令，攜帶私網服務器指定的用於數據連接的IP和PORT信息，被動地等待客戶端來連接；","attrs":{}}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"PASV響應命令到達防火牆時，報文載荷中的私網IP（192.168.12.2）和PORT（C=31920=124*256+176）會被轉換成爲公網IP（106.120.22.2）和PORT（C'=31920=124*256+176）；","attrs":{}}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"公網客戶端收到PASV響應命令後解析其內容，發送數據連接（源IP-106.120.12.2、目的IP-106.120.22.2、源端口-D=23366、目的端口-C'=31920），經防火牆NAT轉換後（源IP-106.120.12.2、目的IP-192.168.12.2、源端口-D=23366、目的端口C =31920）發送至私網服務器，從而實現公網客戶端訪問私網服務器。","attrs":{}}]}]}],"attrs":{}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"image","attrs":{"src":"https://static001.geekbang.org/infoq/aa/aab64d7466c2ac2480b08088497982df.png","alt":"防火牆ALG技術之FTP協議穿牆術","title":null,"style":[{"key":"width","value":"75%"},{"key":"bordertype","value":"none"}],"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"圖3-2-(a) FTP被動模式穿越DNAT-Client","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"image","attrs":{"src":"https://static001.geekbang.org/infoq/93/930ba5389c1a408f1d0a6b83a39fb264.png","alt":"防火牆ALG技術之FTP協議穿牆術","title":null,"style":[{"key":"width","value":"75%"},{"key":"bordertype","value":"none"}],"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"圖3-2-(b) FTP被動模式穿越DNAT-Server","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"strong","attrs":{}}],"text":"FTP協議主動模式穿越DNAT","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"主動模式穿越DNAT主要用於FTP服務器部署在私網，客戶端需要通過DNAT轉換訪問服務器，如圖4-1所示，描述了FTP主動模式穿越DNAT時的工作流程，此時不需要藉助ALG技術也可以完成穿越防火牆的（爲什麼呢？請思考一下）。","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"image","attrs":{"src":"https://static001.geekbang.org/infoq/e4/e4c1d59f05c2d529b3f18cccc282297f.png","alt":"防火牆ALG技術之FTP協議穿牆術","title":null,"style":[{"key":"width","value":"75%"},{"key":"bordertype","value":"none"}],"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"圖4-1 FTP主動模式穿越DNAT流程圖","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"如圖4-2-(a)和4-2-(b)所示，防火牆配置同“3.FTP協議被動模式穿越DNAT”章節所述，整個通信過程包括以下幾個階段：","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"bulletedlist","content":[{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"公網客戶端與私網服務器之間TCP的三次握手建立控制連接；","attrs":{}}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"公網客戶端發送PORT命令，攜帶公網客戶端指定的用於數據連接的IP和PORT信息；","attrs":{}}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"PORT命令到達防火牆時，報文載荷中的公網IP（106.120.12.2）和PORT（C=23360=91*256+64）不會進行NAT轉換，將原樣轉發至私網服務器；","attrs":{}}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"私網服務器收到PORT命令後解析其內容，並主動向公網客戶端發送數據連接（源IP-192.168.12.2、目的IP-106.120.12.2、源端口-20、目的端口-C=23360），經防火牆NAT轉換後（源IP-106.120.22.2、目的IP-106.120.12.2、源端口-10011、目的端口-C=23360）發送至公網客戶端，從而實現公網客戶端訪問私網服務器。","attrs":{}}]}]}],"attrs":{}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"image","attrs":{"src":"https://static001.geekbang.org/infoq/d3/d303afb3a21dbf4690c8193b728ef929.png","alt":"防火牆ALG技術之FTP協議穿牆術","title":null,"style":[{"key":"width","value":"75%"},{"key":"bordertype","value":"none"}],"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"圖4-2-(a) FTP主動模式穿越DNAT-Client","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"image","attrs":{"src":"https://static001.geekbang.org/infoq/68/6892f898982b4049347e6d9d4c451491.png","alt":"防火牆ALG技術之FTP協議穿牆術","title":null,"style":[{"key":"width","value":"75%"},{"key":"bordertype","value":"none"}],"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"圖4-2-(b) FTP主動模式穿越DNAT-Server","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"heading","attrs":{"align":null,"level":2},"content":[{"type":"text","text":"FTP協議穿越防火牆NAT小結","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"ALG應用在外部地址訪問內部地址的場景下。ALG如果發現報文頭部進行了NAT，並且進一步發現是一條FTP連接時，就需要對PORT/PASV命令中的IP和PORT進行轉換。這樣理解後總結上述幾種場景可以得出如下結論：","attrs":{}}]},{"type":"bulletedlist","content":[{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"私網訪問公網時需要防火牆進行SNAT，主動模式外部地址（Server）訪問內部地址（Client）建立數據連接，因此需要ALG；而被動模式不涉及外部地址想訪問內部地址的過程，故不需要ALG。","attrs":{}}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"公網訪問私網時需要防火牆進行DNAT，被動模式外部地址（Client）訪問內部地址（Server）建立數據連接，因此需要ALG；而主動模式不涉及外部地址想訪問內部地址的過程，故不需要ALG。","attrs":{}}]}]}],"attrs":{}},{"type":"heading","attrs":{"align":null,"level":2},"content":[{"type":"text","text":"附件-FTP協議穿越NAT抓包","attrs":{}}]},{"type":"bulletedlist","content":[{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"01_FTP主動模式穿越SNAT-Client.pcap","attrs":{}}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"02_FTP主動模式穿越SNAT-Server.pcap","attrs":{}}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"03_FTP被動模式穿越SNAT-Client.pcap","attrs":{}}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"04_FTP被動模式穿越SNAT-Server.pcap","attrs":{}}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"05_FTP被動模式穿越DNAT-Client.pcap","attrs":{}}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"06_FTP被動模式穿越DNAT-Server.pcap","attrs":{}}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"07_FTP主動模式穿越DNAT-Client.pcap","attrs":{}}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"08_FTP主動模式穿越DNAT-Server.pcap","attrs":{}}]}]}],"attrs":{}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"​","attrs":{}}]}]}