FTP is a difficult protocol to understand (especially when building firewalls). This is an attempt to do so.

The difficulty arises because FTP generally establishes two connections between client and server. The command connection (on which commands are passed back and forth) and the data connection (on which data is transferred - for example the file that you're trying to 'get' or 'put').

FTP servers generally listen on port 21 for connections coming in from unprivileged ports (a port numbered above 1024) on client computers. Commands are sent back on forth on such connections once they have been established.

When data are being passed, such as when a file transfer is being carried out, the ftp software uses different ports on the client and server. The server, by convention, uses port 20. And a different unprivileged port on the client. That anyway is the case in 'standard' mode. When the ftp connection is in 'passive' mode (the choice of standard or passive modes is made by the client), the server sends data from one of its unprivileged ports to an unprivileged port on the client.

The difference between passive and standard modes is that in standard mode, it is the server that sets up the data connection and in passive mode it is the client. That's why it's called passive - because the server passively sits there and waits for the client to establish the data transfer.

Simple sequence for ftp commands in standard mode:

1. Client connects to server on port 21
2. Client is authenticated
3. Client sends commands
4. Client requests data transfer
5. Server sends data from port 20 to unprivileged port on client
6. Data transfer takes place

Simple sequence for ftp commands in passive mode:

1. Client connects to server on port 21
2. Client is authenticated
3. Client sends commands
4. Client requests data transfer in passive mode
5. Server replies with the port to use
6. Client establishes connection from server's unprivileged port to its own unprivileged port
7. Data transfer takes place

Any firewall rules have to cope with all this. And that will be a later post.

Some ASCII art to help explain:

In 'standard mode':

 ----------                           ----------
|          |port >1024       port 21 |          |
|client    |<----------------------->| server   |
|          |                         |          |
|          |port >1024       port 20 |          |
|          |<----------------------->|          |
 ----------                           ----------



In 'passive mode':

 ----------                           ----------
|          |port >1024       port 21 |          |
|client    |<----------------------->| server   |
|          |                         |          |
|          |port >1024    port >1024 |          |
|          |<----------------------->|          |
 ----------                           ----------

Save/Share: Stumble It!  Subscribe Share on Facebook Digg it Reddit Delicious