FTP exists primarily for the transfer of data between two end points. FTP differs from HTTP (Hyper Text Transfer Protocol, used for serving websites via web browsers) fundamentally, as it is an application made up of typically two distinct TCP connections:
Using these two communication connections, two distinct modes of operation determine in which direction the connections are established - Active mode and Passive mode.
FTP is a TCP based service exclusively. There is no UDP component to FTP. FTP is an unusual service in that it utilizes two ports, a Data port and a Command port (also known as the Control port). Traditionally these are port 21 for the Command (Control) port and port 20 for the Data port. The confusion begins however, when we find that depending on the mode, the data port is not always on port 20.
In active mode FTP, the FTP client software connects from a random unprivileged (unprivileged port is a port which is higher than 1023) port. Let us say N is the FTP server's command port, port no. 21. Then, the client starts listening to port N+1 and sends the FTP command PORT N+1 to the FTP server. The server will then connect back to the client's specified data port from its local data port, which is port no. 20. Here in this mode of FTP, we do not need to open any additional non-secure ports on our servers firewall and hence is secure from the server-side.
In passive mode FTP, the FTP client initiates both connections to the server. When opening an FTP connection, the client opens two random unprivileged ports, let us say N and N+1. The first port contacts the server on port no. 21, but instead of then issuing a PORT command and allowing the server to connect back to its data port, the client will issue the PASV command. The result of this is that the server then opens a random unprivileged port, let us say P, and sends the PORT command back to the client. The client then initiates the connection from port no. N+1 to port no. P on the server to transfer data. This method of FTP is insecure, as a random unprivileged port is opened on the Server. This is a potential security issue and it isn't advisable to use the Passive mode of FTP.
Rajeev Kumar is the primary author of How2Lab. He is a B.Tech. from IIT Kanpur with several years of experience in IT education and Software development. He has taught a wide spectrum of people including fresh young talents, students of premier engineering colleges & management institutes, and IT professionals.
Rajeev has founded Computer Solutions & Web Services Worldwide. He has hands-on experience of building variety of websites and business applications, that include - SaaS based erp & e-commerce systems, and cloud deployed operations management software for health-care, manufacturing and other industries.