FTP

The File Transfer Protocol (FTP) is a standard network protocol used for the transfer of computer files between a client and server on a computer network. Based on a client-server model architecture, FTP uses separate control and data connections between the client and the server.

Developed in the early days of the ARPANET, FTP is one of the oldest protocols still in use today, dating back to 1971. While efficient for its time, it has significant security drawbacks compared to modern file transfer methods.

Overview and Purpose

The primary purpose of FTP is to enable users to upload files to a server (putting files onto the server) and download files from a server (retrieving files from the server). It operates using two distinct connections:

1. Control Connection: Established on port 21 by default. This connection is used for sending commands from the client to the server (e.g., login credentials, navigate directories, initiate file transfer) and receiving responses from the server (e.g., command successful, file not found, ready to transfer). 2. Data Connection: Established on various ports. This connection is used for the actual transfer of file data. The port used for the data connection is negotiated over the control connection and depends on whether the transfer is in Active or Passive mode.

How it Works: Active vs. Passive Mode

The setup of the data connection distinguishes between Active and Passive FTP modes:

Active Mode FTP

1. The client connects to the server's control port (default 21) and sends commands.

2. When initiating a data transfer (e.g., a download), the client tells the server which data port the *client* is listening on.

3. The server then actively initiates a connection *back to* the client on the specified data port (typically originating from server port 20).

- Issue with Firewalls/NAT: Active mode often causes problems with firewalls and NAT (Network Address Translation) on the client's side. The firewall may block the incoming connection initiated by the server, or the NAT device may not correctly route the incoming connection to the client behind it.

Passive Mode FTP

1. The client connects to the server's control port (default 21) and sends commands.

2. When initiating a data transfer, the client sends a `PASV` command to the server.

3. The server responds by telling the client which data port the *server* is listening on.

4. The client then initiates a connection *to* the server on that specified data port.

- Advantage with Firewalls/NAT: Passive mode is generally more compatible with client-side firewalls and NAT because the client always initiates the connections, which is typically allowed by firewalls.

Due to the widespread use of firewalls and NAT on client networks, Passive mode is the preferred and more reliable method for most FTP connections today.

History

FTP was originally specified in 1971, making it one of the earliest networking protocols. It predates the widespread adoption of TCP/IP, initially running over protocols like NCP. It was later updated to run over TCP/IP and standardized in RFC 959 in 1985, which remains the fundamental specification. Despite its age, its simplicity kept it relevant for basic file transfers for decades.

Security Concerns

A major drawback of standard FTP is its lack of encryption. By default:

• Authentication is sent in plaintext: Usernames and passwords are sent over the control connection without encryption. Anyone intercepting the traffic can capture login credentials.
• Data is sent in plaintext: The actual file data transferred over the data connection is also unencrypted. Sensitive information contained within files can be read by anyone monitoring the network traffic.

Due to these significant security risks, using plain FTP (especially over untrusted networks like the internet) is strongly discouraged.

Alternatives for Secure File Transfer

To address the security concerns of standard FTP, several secure alternatives exist:

• SFTP (SSH File Transfer Protocol): Runs over the SSH protocol (typically on port 22). SFTP provides both authentication and data encryption by leveraging SSH's secure channel. It is a completely different protocol from FTP, despite the similar name.
• FTPS (FTP Secure): Standard FTP enhanced with TLS/SSL encryption. It typically uses port 21 for the control connection (which is then secured with TLS/SSL) and negotiates secure data connections. It is an extension of FTP, not a separate protocol like SFTP.
• SCP (Secure Copy Protocol): Also runs over SSH. Primarily designed for simple file transfers from the command line, it is less feature-rich than SFTP but often faster for bulk transfers.

Important Warning for Seedboxes and Private Servers:

• Connecting to services like Pulsed Media Seedboxes or other private servers using standard **FTP on port 21 can often result in connection errors**, particularly when your client is behind a firewall or NAT and attempting to use Active mode, or even due to server-side configurations or firewalls.
• More importantly, standard FTP transmits your username, password, and file data in plaintext, posing a significant security risk.
• It is highly recommended to use SFTP (SSH File Transfer Protocol) which typically runs over SSH on port 22. SFTP encrypts all data and authentication, is generally more reliable with firewalls (as the client initiates all connections), and offers a secure alternative for file transfers to and from your seedbox or server.

FXP (File eXchange Protocol)

While sometimes discussed as a distinct protocol, FXP isn't a separate standard but rather a specific mode of operation for FTP servers and clients. FXP allows direct server-to-server data transfer, bypassing the client machine.

In standard FTP, when transferring between two remote servers via a client, the data flows from Server A to the Client, and then from the Client to Server B. FXP attempts to eliminate the client as an intermediary. When the client issues an FXP transfer command, it tells Server A to connect directly to Server B on a specified data port to transfer the file.

FXP essentially works by disabling a security check (IP authentication) on the servers that prevents the server from connecting to an unexpected IP for the data connection. While useful for speed when transferring large amounts of data between servers without involving the client's limited bandwidth, it makes the FTP server vulnerable to FTP bounce attacks. Because of this vulnerability, FXP is disabled by default in most modern FTP server software.

Pulsed Media seedboxes historically have FXP enabled, though users should be aware of the associated security implications if not using it carefully.

FTP Client Software

Many software applications are available that function as FTP clients, allowing users to connect to FTP servers and perform file transfers. Modern clients often support secure protocols like SFTP and FTPS in addition to standard FTP. Some popular examples include:

• FileZilla (Cross-platform, supports FTP, FTPS, SFTP)
• SmartFTP (Windows, supports FTP, FTPS, SFTP)
• CuteFTP (Windows, supports FTP, FTPS, SFTP)
• FlashFXP (Windows, supports FTP, FTPS, SFTP)
• WinSCP (Windows, supports SFTP, SCP, FTPS, FTP)
• Various command-line clients included in operating systems (e.g., `ftp`, `sftp`, `scp`).

See also

• SFTP
• FTPS
• SSH
• TCP/IP
• Client–server model
• File transfer
• Network protocol
• Port (computer networking)
• NAT
• Firewall

External links

• RFC 959 - File Transfer Protocol
• Cloudflare: What is FTP?
• SSH.com: What is SFTP?