Active and passive FTP
Active FTP
See how PORT tells the server where to open the next data connection back to the client.
8 minute lesson
In classic active mode, the client listens for a data connection and sends a PORT command containing its address and port. The server opens the connection back to that endpoint.
This direction was natural when clients were directly reachable. It is awkward when a laptop sits behind NAT or a firewall that blocks unexpected incoming connections.
Active mode changes only the data channel. The client still opened the control connection to port 21.
The endpoint is encoded in PORT:
C: PORT 192,0,2,44,195,80
S: 200 PORT command successful
C: RETR report.csvThe port is 195 * 256 + 80, which is 50000. The server then tries to connect to 192.0.2.44:50000 for the transfer.
That address must be reachable from the server. A client behind NAT often advertises a private address or cannot accept the inbound connection. The control login still works, which makes the later 425 look confusing.
Servers should reject PORT endpoints that target unrelated hosts or unsafe ports. Otherwise the server can be abused as a relay in an FTP bounce attack.
Trace one active transfer on a test network. Identify the advertised client endpoint, the server’s outbound connection attempt, and the final reply after the data socket closes.
Lesson completed