VMware ESXi and vSphere Cluster Management

File Transfer Protocol (FTP)

Learn how FTP transfers files between clients and servers, how control and data connections use TCP ports 21 and 20, how active and passive modes work, and why FTP is not secure for sensitive data.

File Transfer Protocol (FTP) is an application-layer protocol for transferring files between hosts over an IP network. An FTP session can be used to upload files to a server, download files from a server, view remote directories, and manage remote files when the account has permission.

FTP uses TCP because file transfers and commands need a reliable, ordered connection. The protocol is separate from the applications that provide its user interface, such as a graphical FTP client or a command-line client.

How FTP Uses a Client-Server Model

An FTP client is software running on the user's local host. It initiates a connection to an FTP server, which is a host and service that accepts FTP connections and provides authorized access to files and directories.

The local machine and remote server have different roles:

• Local host: The computer running the FTP client and holding files that may be uploaded.
• Remote FTP server: The computer providing directories and files through the FTP service.
• FTP client: Initiates the session, sends commands, and displays server responses.
• FTP server: Authenticates users, checks permissions, performs requested operations, and sends replies.

A typical session follows this sequence:

1. The client initiates a TCP control connection to the server.
2. The server responds with a greeting or status message.
3. The user authenticates with a username and password, or selects anonymous access if the server permits it.
4. The client sends commands to browse directories or manage files.
5. The client and server create data connections for directory listings and file contents.
6. The client ends the session with a logout command.

FTP Control and Data Connections

FTP separates conversation and file-transfer traffic into two logical TCP connections. This separation is a central feature of FTP.

The control connection is the persistent channel used for authentication, commands, server replies, and session management. It normally connects to the server's TCP port 21 and remains open while the FTP session is active.

The data connection is a separate channel used for directory listings and file contents. A new data connection may be created for an individual directory listing, upload, or download. The control connection tells the server what operation to perform; the data connection carries the result.

FTP Ports and Connection Modes

TCP port 21: the control connection

TCP port 21 is the default FTP control port. A client normally connects to this port to begin authentication and exchange FTP commands. Allowing port 21 alone is not always enough for successful transfers because directory listings and file contents use a separate data connection.

Active FTP mode

In active FTP, the client opens the control connection to the server. When a data operation is needed, the server initiates the data connection back toward the client. The server traditionally uses TCP port 20 as the source port for this connection.

Active mode can be difficult when the client is behind a firewall or network address translation (NAT). The server's incoming connection may be blocked or may not reach the correct private client address.

Passive FTP mode

In passive FTP, the client initiates both the control connection and the data connection. The client first asks the server to enter passive mode. The server then provides a high-numbered TCP port, and the client connects to that server-provided port for the listing or transfer.

Passive mode is commonly preferable for clients behind firewalls or NAT because outbound connections from the client are usually easier to permit than unexpected inbound connections. The server firewall must allow the configured passive-port range, and the server must advertise an address reachable by the client.

Authentication and Anonymous FTP

For a standard FTP account, the client submits a username and password. The server then decides whether the account is allowed to connect and what files or directories it may access.

Anonymous FTP is a server configuration that permits access using an anonymous identity rather than a unique named account. It is often used to distribute public files. Some servers request the username anonymous and may accept an email address or another value as the password.

Anonymous access is controlled by the server. It may be limited to downloading files, browsing particular directories, or accessing a restricted portion of the filesystem. Anonymous access does not inherently grant permission to upload, delete, rename, or modify files.

Common FTP Operations

After authentication, a user can perform operations allowed by the account and directory permissions:

• List the contents of a remote directory.
• Change the current remote directory.
• Download a file from the server.
• Upload a local file to the server.
• Rename or delete a remote file when authorized.
• End the session cleanly.

These commands describe the protocol vocabulary; users normally issue them through a graphical client or command-line program rather than typing every command manually.

Practical Example: Anonymous Download

1. Open a graphical FTP client such as FileZilla.
2. Enter the FTP server's hostname or IP address and use the default control port, 21.
3. Select or enter anonymous authentication if the server allows it.
4. After the control session connects, browse the permitted remote directory.
5. Select a public file to download. The client and server use an FTP data connection for the directory listing and file contents.

This example shows that the FTP client initiates the control session, while anonymous access is a server-side decision. The user can see only the directories and files permitted by the server.

Practical Example: Authenticated Upload

1. Connect to the organization's FTP server using an assigned username and password.
2. Change to a remote directory where the account has write permission.
3. Upload a local file.
4. Check the client status and remote directory to confirm that the transfer completed.

Successful authentication does not automatically mean that every operation is allowed. Account permissions, directory permissions, quotas, filename rules, and server policies determine whether an upload succeeds.

Practical Example: Passive Mode Behind a Firewall

1. The client establishes the control connection to server TCP port 21.
2. The client requests passive mode.
3. The server replies with a negotiated high-numbered TCP port.
4. The client opens the data connection to that server-provided port.
5. The listing or file transfer proceeds over the data connection.

In this example, the data connection does not use TCP port 20 in the active-mode sense. Firewall rules must permit the server's configured passive-port range.

FTP Security Limitations

Traditional FTP does not encrypt its traffic. Usernames, passwords, commands, directory information, and transferred file contents are sent in clear text. Clear text means data is transmitted without encryption, so someone able to observe the traffic may be able to read it.

This creates several risks:

• An attacker on an untrusted network may capture usernames and passwords.
• Transferred files may be intercepted and read.
• Commands and directory activity may be observed.
• Captured credentials may be reused against the FTP account or other services.

Traditional FTP should not be selected for confidential data merely because it uses TCP or requires a password. TCP provides reliable delivery, not confidentiality. Use an appropriately secured alternative or a carefully protected network design for sensitive transfers.

FTP, SFTP, and FTPS

SFTP means SSH File Transfer Protocol. It is distinct from FTP and operates through SSH. FTPS means FTP protected with Transport Layer Security (TLS). SFTP and FTPS are not interchangeable names for the same technology.

Firewall and NAT Configuration Concepts

• Permit client access to the FTP server's TCP port 21 for the control connection.
• For active mode, account for server-initiated data connections toward client-side ports.
• For passive mode, configure a limited server passive-port range and permit that range through the firewall.
• Ensure NAT or firewall devices do not advertise or translate an unreachable address for passive data connections.

Exact rules depend on the FTP server, client, firewall, NAT device, and security policy. Avoid opening an unnecessarily broad range of ports.

Troubleshooting FTP

Login succeeds, but listings or transfers fail

Likely causes include a blocked data connection, an active/passive mode mismatch, or a passive-port range that is not allowed through the firewall.

• Confirm whether the client is using active or passive mode.
• Verify firewall rules for the applicable data-connection direction and port range.
• Review FTP client and server logs for data-channel errors.

Authentication fails

Check for an incorrect username or password, disabled anonymous access, an incorrectly formatted anonymous login, or an account that is disabled, locked, or not permitted to use FTP.

• Verify the selected authentication method.
• Confirm credentials and account authorization with the server administrator.
• Check server logs for the authentication rejection reason.

Connection succeeds, but upload fails

The account may have read-only access, the destination directory may not permit writing, or a quota, filename restriction, or server policy may block the upload.

• Verify directory permissions and account upload privileges.
• Confirm available storage and server-side file restrictions.
• Try an authorized destination directory.

Credentials or files appear in a network capture

This usually indicates that traditional FTP is being used without encryption.

• Confirm whether the service is plain FTP rather than FTPS or SFTP.
• Move sensitive transfers to SFTP or an appropriately configured FTPS service.

Key Points to Remember

• FTP is an application-layer protocol for exchanging files between a client and server over TCP/IP.
• The client normally initiates a control connection to TCP port 21.
• FTP uses a separate data connection for directory listings and file contents.
• Active mode has the server initiate the data connection and conventionally uses TCP port 20 as the server-side source port.
• Passive mode has the client initiate the data connection to a server-selected high-numbered port.
• Anonymous FTP is limited by server configuration and does not automatically allow uploads or unrestricted access.
• Traditional FTP sends credentials and content without encryption.
• SFTP uses SSH, while FTPS uses FTP with TLS; neither is simply the same as plain FTP.

For a related reference, see File Transfer Protocol (FTP).