Common FTP Port Numbers and Their Uses

Common FTP Port Numbers and Their Uses

File Transfer Protocol (FTP) is a widely used network protocol for transferring files between a client and a server on a computer network. Understanding FTP port numbers is crucial for configuring firewalls, troubleshooting connectivity issues, and ensuring secure data transfers. This article provides a detailed description of common FTP port numbers and their specific uses.

The Core Concept: Active vs. Passive Mode

Before diving into specific port numbers, it’s essential to understand the difference between Active and Passive FTP modes. These modes fundamentally affect which ports are used and who initiates the data connection.

• Active Mode:

  • The client initiates the control connection (typically to port 21).
  • The client then opens a random, unprivileged port (typically >1023) and tells the server this port number (and its IP address) using the PORT command.
  • The server then initiates the data connection back to the client’s specified port. This is the crucial point: the server initiates the data connection to the client.
  • This can be problematic with firewalls on the client side, as the firewall might block this incoming connection from the server.

• Passive Mode (PASV):

  • The client initiates the control connection (typically to port 21).
  • The client sends the PASV command to the server.
  • The server then opens a random, unprivileged port (typically >1023) and tells the client this port number (and the server’s IP address) in the response to the PASV command.
  • The client initiates the data connection to the server’s specified port. Here, the client initiates both connections.
  • Passive mode is generally preferred because it’s more firewall-friendly on the client side. Most modern FTP clients use passive mode by default.

Key Port Numbers:

1. Port 21 (TCP): FTP Control Connection (Command Port)

   • This is the primary port used by FTP.
   • It’s used for establishing the control connection between the client and the server.
   • All FTP commands (e.g., USER, PASS, LIST, RETR, STOR, PORT, PASV) are sent over this connection.
   • The control connection remains open throughout the entire FTP session.
   • It’s used in both Active and Passive modes. The key difference is what happens after the control connection is established.

2. Port 20 (TCP): FTP Data Connection (Active Mode)

   • This port is used for the data connection only in Active Mode.
   • The server initiates the connection from port 20 to the client’s dynamically chosen port (as specified by the client’s PORT command).
   • This port is not used in Passive Mode. Passive Mode uses a dynamically allocated port on the server side for the data connection.

3. Ports > 1023 (TCP): Dynamic/Ephemeral Ports (Active and Passive Mode)

   • These are not fixed port numbers. They are dynamically chosen by the operating system.
   • Active Mode: The client chooses a random port > 1023 and tells the server to connect to it for data transfer.
   • Passive Mode: The server chooses a random port > 1023 and tells the client to connect to it for data transfer.
   • The range of these ports can often be configured on the FTP server (and sometimes on the client). This is important for firewall configuration. For example, you might restrict the server to use ports 50000-51000 for passive mode connections.

4. Port 990 (TCP): Implicit FTPS (FTP Secure) Control Connection

   • Used for implicit FTPS, an older method of securing FTP communication with SSL/TLS.
   • With implicit FTPS, the connection immediately negotiates SSL/TLS security before any FTP commands are exchanged.
   • This is different from explicit FTPS (see below).

5. Port 989 (TCP): Implicit FTPS (FTP Secure) Data Connection

   • Used for data connection when implicit FTPS is enabled.
   • Not frequently used.

6. No specific Port: Explicit FTPS (FTP Secure)

   • Explicit FTPS, also known as FTPES, is the preferred method for securing FTP.
   • It uses the standard FTP port 21 for the initial connection.
   • The client then explicitly requests security using the AUTH TLS or AUTH SSL command.
   • The control connection is then secured using SSL/TLS.
   • For the data connection, the same principles of Active and Passive mode apply. Either port 20 (Active) or a dynamic port (Passive) is used, but the connection is secured.
   • Explicit FTPS is more flexible than implicit FTPS because it allows clients that don’t support SSL/TLS to still connect (though without security).

Summary Table:

| Port Number | Protocol | Mode | Description |
| :———- | :——- | :———– | :———————————————————————————————————— |
| 21 | TCP | Both | FTP Control Connection (Commands) |
| 20 | TCP | Active | FTP Data Connection (Server initiates connection to client) |
| >1023 | TCP | Both | Dynamically allocated ports for data connections (Client in Active, Server in Passive) |
| 990 | TCP | Implicit FTPS| FTPS Control Connection (Implicit SSL/TLS) |
| 989 | TCP | Implicit FTPS| FTPS Data Connection (Implicit SSL/TLS) |
| 21 (then negotiated) | TCP | Explicit FTPS| FTPS Control Connection. Standard port, security negotiated after connection using AUTH TLS/SSL. |
| 20 or >1023 (then negotiated) | TCP |Explicit FTPS | FTPS Data Connection. Standard principles, security negotiated after control connection is secured.|

Practical Considerations:

• Firewall Configuration: Firewalls must be configured to allow traffic on the appropriate FTP ports. Passive mode is generally easier to configure, as only the server’s ports (21 and the dynamic range) need to be opened. Active mode requires opening ports on the client side, which is often undesirable.
• FTP Server Configuration: FTP servers typically allow administrators to specify the range of ports used for passive mode data connections. This helps in firewall configuration.
• Security: Plain FTP (ports 21 and 20) transmits data in plain text, including usernames and passwords. It’s strongly recommended to use FTPS (preferably explicit FTPS) for secure file transfers.
• SFTP (SSH File Transfer Protocol): SFTP is a completely different protocol from FTP and FTPS. It uses SSH (Secure Shell) and typically runs on port 22. It’s a more secure and often preferred alternative to FTP.

By understanding these common FTP port numbers and their uses, you can effectively configure your network, troubleshoot connectivity problems, and ensure secure data transfers when using FTP. Always prioritize secure methods like FTPS or SFTP over plain FTP.