Describe in detail the first three packets you would see in an FTP session between client 192.168.1.132 and server 192.168.1.110; include port numbers, flags, and any other pertinent options that would be set.

What will be an ideal response?

1. In the first packet, the computer at IP address 192.168.1.132:50580 attempts to connect to the FTP server at 192.168.1.110:21.  The packet has the SYN flag set because a synchronization request is being made to the remote server. The sequence number of the packet is set at 0 with a window size of 8192.
There is no acknowledgement number because this is the first packet of the session; in other words, there is no previous packet to acknowledge.

2. In the second packet, the FTP server responds to the client by sending a packet from its port 21 with the ACK and SYN flags set. The server uses the same initial sequence number as the client used in packet 1, but the server increments the client's initial sequence number by one to create an acknowledgement number. This number is sent back to the client to acknowledge that the server received the first packet.

3. In the third packet, the client responds with a packet that has the ACK flag set. This concludes the three-way handshake.