万花筒写轮眼之防火墙ALG技术之FTP协议穿墙术

{"type":"doc","content":[{"type":"heading","attrs":{"align":null,"level":2},"content":[{"type":"text","text":"FTP协议主动模式穿越SNAT","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"主动模式穿越SNAT主要用于FTP服务器部署在公网，客户端需要通过SNAT转换访问服务器。如图1-1所示，描述了FTP主动模式穿越SNAT时的工作流程，此时需要借助ALG技术才可以完成穿越防火墙。","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"image","attrs":{"src":"https://static001.geekbang.org/infoq/eb/eb8f3f18e665b5c8a25d1bce7042b2f6.png","alt":"防火墙ALG技术之FTP协议穿墙术","title":null,"style":[{"key":"width","value":"75%"},{"key":"bordertype","value":"none"}],"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"图1-1 FTP主动模式穿越SNAT流程图","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"防火墙设备上配置了私网地址192.168.12.2到公网地址106.120.22.2/FTP服务的映射，实现IP地址的转换，以支持私网客户端对公网服务器的访问。组网中，若没有ALG对报文载荷的处理（图1-1中红色字体部分内容的变化），私网客户端发送的PORT报文到达公网服务器端后，服务器无法根据私网地址进行路由，也就无法正常地建立数据连接，从而导致私网客户端访问公网FTP服务器失败。如图1-2-(a)和图1-2-(b)所示，整个通信过程包括以下几个阶段：","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"bulletedlist","content":[{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"私网客户端与公网服务器之间TCP的三次握手建立控制连接；","attrs":{}}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"私网客户端发送PORT命令，携带私网客户端指定的用于数据连接的IP和PORT信息；","attrs":{}}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"PORT命令到达防火墙时，报文载荷中的私网IP（192.168.12.2）和PORT（Y=31272=122*256+40）会被转换成为公网IP（106.120.22.2）和PORT（Y'=31272=122*256+40）；","attrs":{}}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"公网服务器收到PORT命令后解析其内容，并主动向私网客户端发送数据连接（源IP-106.120.12.2、目的IP-106.120.22.2、源端口-20、目的端口-Y'=31272），经防火墙NAT转换后（源IP-106.120.12.2、目的IP-192.168.12.2、源端口-20、目的端口Y=31272）发送至公网服务器，从而实现私网客户端访问公网服务器。","attrs":{}}]}]}],"attrs":{}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"image","attrs":{"src":"https://static001.geekbang.org/infoq/1e/1ef104c081da5695cbf9616bf5825a83.png","alt":"防火墙ALG技术之FTP协议穿墙术","title":null,"style":[{"key":"width","value":"75%"},{"key":"bordertype","value":"none"}],"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"图1-2-(a) FTP主动模式穿越SNAT-Client","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"image","attrs":{"src":"https://static001.geekbang.org/infoq/17/173ffe2904b26a9f08b9dcd0c6968e25.png","alt":"防火墙ALG技术之FTP协议穿墙术","title":null,"style":[{"key":"width","value":"75%"},{"key":"bordertype","value":"none"}],"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"图1-2-(b) FTP主动模式穿越SNAT-Server","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"heading","attrs":{"align":null,"level":2},"content":[{"type":"text","text":"FTP协议被动模式穿越SNAT","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"被动模式穿越SNAT主要用于FTP服务器部署在公网，客户端需要通过SNAT转换访问服务器。如图2-1所示，描述了FTP被动模式穿越SNAT时的工作流程，此时不需要借助ALG技术也可以完成穿越防火墙的（为什么呢？请思考一下）。","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"image","attrs":{"src":"https://static001.geekbang.org/infoq/e9/e923076fda7ac8b0641b59cfe7840a46.png","alt":"防火墙ALG技术之FTP协议穿墙术","title":null,"style":[{"key":"width","value":"75%"},{"key":"bordertype","value":"none"}],"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"图2-1 FTP被动模式穿越SNAT流程图","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"如图2-2-(a)和2-2-(b)所示，防火墙配置同“1.FTP协议主动模式穿越SNAT”章节所述，整个通信过程包括以下几个阶段：","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"bulletedlist","content":[{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"私网客户端与公网服务器之间TCP的三次握手建立控制连接；","attrs":{}}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"私网客户端发送PASV命令，公网服务器响应PASV命令，携带公网服务器指定的用于数据连接的IP和PORT信息，被动地等待客户端来连接；","attrs":{}}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"PASV响应命令到达防火墙时，报文载荷中的公网IP（106.120.12.2）和PORT（Z=23076=90*256+36）不会进行NAT转换，将原样转发至私网客户端；","attrs":{}}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"私网客户端收到PASV响应命令后解析其内容，发送数据连接（源IP-192.168.12.2、目的IP-106.120.12.2、源端口-Y=31277、目的端口- Z=23076），经防火墙NAT转换后（源IP-106.120.22.2、目的IP-106.120.12.2、源端口-Y'=10009、目的端口Z=23076）发送至公网服务器，从而实现私网客户端访问公网服务器。","attrs":{}}]}]}],"attrs":{}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"图2-2-(a) FTP被动模式穿越SNAT-Client","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"image","attrs":{"src":"https://static001.geekbang.org/infoq/4c/4c85bbe1d52bd58cda3a38933c2be1bc.png","alt":"防火墙ALG技术之FTP协议穿墙术","title":null,"style":[{"key":"width","value":"75%"},{"key":"bordertype","value":"none"}],"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"图2-2-(b) FTP被动模式穿越SNAT-Server","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"image","attrs":{"src":"https://static001.geekbang.org/infoq/4c/4c85bbe1d52bd58cda3a38933c2be1bc.png","alt":"防火墙ALG技术之FTP协议穿墙术","title":null,"style":[{"key":"width","value":"75%"},{"key":"bordertype","value":"none"}],"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"heading","attrs":{"align":null,"level":2},"content":[{"type":"text","text":"FTP协议被动模式穿越DNAT","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"被动模式穿越DNAT主要用于FTP服务器部署在私网，客户端需要通过DNAT转换访问服务器，如图3-1所示，描述了FTP被动模式穿越DNAT时的工作流程，此时需要借助ALG技术才可以完成穿越防火墙。","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"image","attrs":{"src":"https://static001.geekbang.org/infoq/83/834ad371a194019b2fc991ad71bfa23e.png","alt":"防火墙ALG技术之FTP协议穿墙术","title":null,"style":[{"key":"width","value":"75%"},{"key":"bordertype","value":"none"}],"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"图3-1 FTP被动模式穿越DNAT流程图","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"防火墙设备上配置了私网地址192.168.12.2/TCP私网端口21到公网地址106.120.22.2/TCP公网端口2100的映射，实现IP地址的转换，以支持公网客户端对私网服务器的访问。组网中，若没有ALG对报文载荷的处理（图3-1中红色字体部分内容的变化），私网服务器发送的PASV响应报文到达公网客户端后，客户端无法根据私网地址进行路由，也就无法建立正确的数据连接。如图3-2-(a)和图3-2-(b)所示，整个通信过程包括以下几个阶段：","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"bulletedlist","content":[{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"公网客户端与私网服务器之间TCP的三次握手建立控制连接；","attrs":{}}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"公网客户端发送PASV命令，私网服务器响应PASV命令，携带私网服务器指定的用于数据连接的IP和PORT信息，被动地等待客户端来连接；","attrs":{}}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"PASV响应命令到达防火墙时，报文载荷中的私网IP（192.168.12.2）和PORT（C=31920=124*256+176）会被转换成为公网IP（106.120.22.2）和PORT（C'=31920=124*256+176）；","attrs":{}}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"公网客户端收到PASV响应命令后解析其内容，发送数据连接（源IP-106.120.12.2、目的IP-106.120.22.2、源端口-D=23366、目的端口-C'=31920），经防火墙NAT转换后（源IP-106.120.12.2、目的IP-192.168.12.2、源端口-D=23366、目的端口C =31920）发送至私网服务器，从而实现公网客户端访问私网服务器。","attrs":{}}]}]}],"attrs":{}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"image","attrs":{"src":"https://static001.geekbang.org/infoq/aa/aab64d7466c2ac2480b08088497982df.png","alt":"防火墙ALG技术之FTP协议穿墙术","title":null,"style":[{"key":"width","value":"75%"},{"key":"bordertype","value":"none"}],"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"图3-2-(a) FTP被动模式穿越DNAT-Client","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"image","attrs":{"src":"https://static001.geekbang.org/infoq/93/930ba5389c1a408f1d0a6b83a39fb264.png","alt":"防火墙ALG技术之FTP协议穿墙术","title":null,"style":[{"key":"width","value":"75%"},{"key":"bordertype","value":"none"}],"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"图3-2-(b) FTP被动模式穿越DNAT-Server","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"strong","attrs":{}}],"text":"FTP协议主动模式穿越DNAT","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"主动模式穿越DNAT主要用于FTP服务器部署在私网，客户端需要通过DNAT转换访问服务器，如图4-1所示，描述了FTP主动模式穿越DNAT时的工作流程，此时不需要借助ALG技术也可以完成穿越防火墙的（为什么呢？请思考一下）。","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"image","attrs":{"src":"https://static001.geekbang.org/infoq/e4/e4c1d59f05c2d529b3f18cccc282297f.png","alt":"防火墙ALG技术之FTP协议穿墙术","title":null,"style":[{"key":"width","value":"75%"},{"key":"bordertype","value":"none"}],"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"图4-1 FTP主动模式穿越DNAT流程图","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"如图4-2-(a)和4-2-(b)所示，防火墙配置同“3.FTP协议被动模式穿越DNAT”章节所述，整个通信过程包括以下几个阶段：","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"bulletedlist","content":[{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"公网客户端与私网服务器之间TCP的三次握手建立控制连接；","attrs":{}}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"公网客户端发送PORT命令，携带公网客户端指定的用于数据连接的IP和PORT信息；","attrs":{}}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"PORT命令到达防火墙时，报文载荷中的公网IP（106.120.12.2）和PORT（C=23360=91*256+64）不会进行NAT转换，将原样转发至私网服务器；","attrs":{}}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"私网服务器收到PORT命令后解析其内容，并主动向公网客户端发送数据连接（源IP-192.168.12.2、目的IP-106.120.12.2、源端口-20、目的端口-C=23360），经防火墙NAT转换后（源IP-106.120.22.2、目的IP-106.120.12.2、源端口-10011、目的端口-C=23360）发送至公网客户端，从而实现公网客户端访问私网服务器。","attrs":{}}]}]}],"attrs":{}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"image","attrs":{"src":"https://static001.geekbang.org/infoq/d3/d303afb3a21dbf4690c8193b728ef929.png","alt":"防火墙ALG技术之FTP协议穿墙术","title":null,"style":[{"key":"width","value":"75%"},{"key":"bordertype","value":"none"}],"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"图4-2-(a) FTP主动模式穿越DNAT-Client","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"image","attrs":{"src":"https://static001.geekbang.org/infoq/68/6892f898982b4049347e6d9d4c451491.png","alt":"防火墙ALG技术之FTP协议穿墙术","title":null,"style":[{"key":"width","value":"75%"},{"key":"bordertype","value":"none"}],"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"图4-2-(b) FTP主动模式穿越DNAT-Server","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"heading","attrs":{"align":null,"level":2},"content":[{"type":"text","text":"FTP协议穿越防火墙NAT小结","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"ALG应用在外部地址访问内部地址的场景下。ALG如果发现报文头部进行了NAT，并且进一步发现是一条FTP连接时，就需要对PORT/PASV命令中的IP和PORT进行转换。这样理解后总结上述几种场景可以得出如下结论：","attrs":{}}]},{"type":"bulletedlist","content":[{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"私网访问公网时需要防火墙进行SNAT，主动模式外部地址（Server）访问内部地址（Client）建立数据连接，因此需要ALG；而被动模式不涉及外部地址想访问内部地址的过程，故不需要ALG。","attrs":{}}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"公网访问私网时需要防火墙进行DNAT，被动模式外部地址（Client）访问内部地址（Server）建立数据连接，因此需要ALG；而主动模式不涉及外部地址想访问内部地址的过程，故不需要ALG。","attrs":{}}]}]}],"attrs":{}},{"type":"heading","attrs":{"align":null,"level":2},"content":[{"type":"text","text":"附件-FTP协议穿越NAT抓包","attrs":{}}]},{"type":"bulletedlist","content":[{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"01_FTP主动模式穿越SNAT-Client.pcap","attrs":{}}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"02_FTP主动模式穿越SNAT-Server.pcap","attrs":{}}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"03_FTP被动模式穿越SNAT-Client.pcap","attrs":{}}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"04_FTP被动模式穿越SNAT-Server.pcap","attrs":{}}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"05_FTP被动模式穿越DNAT-Client.pcap","attrs":{}}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"06_FTP被动模式穿越DNAT-Server.pcap","attrs":{}}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"07_FTP主动模式穿越DNAT-Client.pcap","attrs":{}}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"08_FTP主动模式穿越DNAT-Server.pcap","attrs":{}}]}]}],"attrs":{}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"​","attrs":{}}]}]}