Ftp – trace ftp file data in wireshark

This is probably because FTP.exe take control over the shell. So redirections, that are handled by the cmd.exe have no effect.

What you can do, is use the -s:filename option and redirect the whole ftp output to a file. It will contain more then you want, but you can take care of that later.

Or, maybe, look for other ftp clients that have this functionality ( I am not aware of any).

FTP server and FTP client negotiates which ports are going to be used for the transfer of data (including the directory list when you do a "dir" or "ls") using the "control channel" of FTP. So if your "AWS firewall" is not doing protocol inspection on this channel there is no way he will know which ports it has to dynamically open to allow the traffic flow (and close once those ports are not longer used).

IMHO using network monitoring to discover which ports are being used is not worth the effort because these ports are going to change for every new FTP session.

Unless you have already done it, my best shot at troubleshooting this issue would be to look for any tweak on the firewall that is protecting your FTP server (if I understand your question correctly this would be the "AWS firewall") and see if there is any "knob" to enable inspection for the FTP protocol.