I am using Wireshark to see if a little FTP client we wrote is using TLS v1.0, v1.1, or v1.2.

In the "protocol" column, I see TLS 1.2 listed on some things, but when I filter to only the FTP IP addresses, all I see is TCP. I do not see any indication which TLS version it is using, or if FTP uses TLS at all...?

Is there a way I can tell which TLS version this FTP program is using?

  • FTPES uses STARTTLS to enable encryption, FTPS uses port 990 by default.
    – Zac67
    Jan 3, 2018 at 15:37
  • Hi Zac67. Thanks for your reply. I am using port 990. In Wireshark shouldn't I be able to determine the TLS version it is using? Does FTPS even use TLS?
    – Jamesiv1
    Jan 3, 2018 at 16:00
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Apr 1, 2018 at 19:20

1 Answer 1


In Wireshark, you should see a packet marked TLSv1.x Client Hello right after the TCP socket is SYN/ACKed.

Additionally, your client can check the socket parameters once it's established - however, this involves coding and is off-topic here. Moreover, the server logs should indicate if and what TLS version is used.

FTPS over TCP port 990 uses implicit SSL/TLS - when the client see the socket come up it's already encrypted, the client doesn't use STARTTLS.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.