File Transfer Protocol (FTP)

1. Introduction to file transfer and FTP

Moving files between computers requires agreed commands and a data-transfer procedure. The File Transfer Protocol (FTP) defines such a set of rules, used for tasks including publishing websites, sharing datasets, and downloading software.

FTP is a that operates on a model. It defines commands such as USER, PASS, LIST, RETR, and STOR for authentication, directory access, and file transfer. The first file-transfer mechanisms were described in the early 1970s, before the World Wide Web. FTP separates a control channel from data connections.

2. Basic architecture: two connections

FTP uses a separate control connection and data connections. The control channel carries commands and replies, while a data channel carries files and directory listings. The way a data connection is established depends on the selected mode.

The control connection

The control connection is the first channel in an FTP session and normally remains active until the session ends. It can still close after an error or timeout. One control session can coordinate several data transfers in sequence. A server may send a 220 greeting, reply 331 when it expects a password, and reply 230 after successful authentication.

Purpose:The channel manages the session. The client sends commands such as login, LIST, and RETR, while the server returns replies, including codes that report an operation's state. Replies 150 and 226 describe preparation and completion of a data transfer, so the control channel remains useful while a file is being sent. These replies coordinate the data channel but do not carry the file bytes themselves.
Port number: The server usually listens for control connections on port $21$ . A deployment can expose the service on another port when the client knows that configuration.
Longevity: The connection is established before login and normally remains open until QUIT or another session termination, such as an error or timeout.
Data type: The connection carries text commands and server replies. File contents use a data connection.

The data connection

The data connection is a temporary channel established to transfer file contents and directory listings. Its creation is associated with operation commands such as LIST, RETR, or STOR and with the selected Active or Passive mode. The TYPE command can select an ASCII or binary representation before the transfer.

Purpose: This channel is used exclusively for transmitting the actual content. This could be a file being downloaded from the server to the client () or a file being uploaded from the client to the server (). Directory listings requested via the 'LIST' command are also sent over the data connection.
Port number: Data-connection ports depend on the transfer mode. In classic Active mode, the server usually uses port $20$ as its source port.
Temporary nature: A data connection is created on demand for each transfer. Depending on the mode, the client or server opens the channel and initiates TCP. It closes after the file or listing is sent, and the next transfer requires a new connection.
Data type: The connection carries file contents in the negotiated transmission mode, such as ASCII or binary, and directory listings. The TYPE command selects the representation, while commands and replies remain on the control channel. Reply codes help the client synchronize the operation state.

Separating the channels keeps session management distinct from content transfer. The control channel can still carry transfer-related commands and replies, including an abort operation, while the data channel carries a file. The control connection therefore does not end merely because a data transfer has finished.

3. Client and server

FTP works through cooperation between a client application and a server.

The FTP Client

The is the application running on the user's local machine. It provides a graphical or command-line interface for connecting to a remote server, browsing directories, and starting transfers. Examples include FileZilla, WinSCP, and CuteFTP. The client initiates the control connection, sends commands, and selects the data mode; in Active mode the server initiates the second channel.

The FTP Server (Daemon)

The , often called an FTP daemon (FTPd), is software running on a remote machine. It listens for client requests on the control port, usually $21$ , and applies file permissions. After connection, the daemon handles authentication, interprets commands, manages the server file system, and establishes and closes data connections.

4. An FTP session

A typical session consists of client commands and three-digit reply codes from the server. A greeting reply precedes login, while replies 150 and 226 report the progress of a data transfer. The following steps show how the two connections cooperate.

Connection and login: The user provides the server address (e.g., 'ftp.example.com'), a username, and a password. The client opens a TCP connection from a local port to server port $21$ , establishing the control connection. The server may first send a 220 greeting. The client then sends USER and PASS, and replies 331 and 230 describe the password prompt and successful login.
Navigation: After login, the user can browse the server file system. The client sends LIST to obtain the files and directories in the current folder; the result travels over a data connection and a control reply reports its status.
Starting a download:The user selects 'report.pdf'. The client sends 'RETR report.pdf' over the control connection; RETR means retrieve.
Opening the data connection: The transfer mode determines how the temporary data connection is opened. In Active mode the client sends its address with PORT and the server connects back; in Passive mode the client sends PASV and connects to a server port. The next section describes both modes.
Data transfer:Once the data connection is established, the server sends 'report.pdf' over that channel. The control channel continues to carry transfer-related replies, including messages about the start and completion of the transfer.
Closing the data connection: After the transfer, the data connection closes and the control connection remains open for the next command.
Ending the session: When the user is finished, the client sends QUIT over the control connection. The server replies and closes the session.

5. Choosing Active or Passive mode

The way the temporary data connection is established affects connectivity through firewalls and NAT devices. FTP defines Active and Passive modes; they differ in which side initiates the data connection.

Active FTP mode

In Active mode, the client tells the server where to send the data, and the server initiates the data connection.

The client connects from port ( $N$ ) to the server's command port $21$ .
When a file transfer is requested, the client listens on a new port, $N+1$ in this example.
The client sends a PORT command with its address and port over the control channel. It tells the server where to make the data connection, for example on port $N+1$ .
The server initiates the data connection to the client's specified port. In the classic configuration, its source port is $20$ .

Possible limitations: A client computer may be behind a and a firewall. Firewall rules can block the server's incoming connection, and a private address in the PORT command may be unreachable from outside the local network. When the client address is routable and the firewall allows the flow, Active mode can work as specified.

Passive FTP mode (PASV)

Passive mode moves initiation of the data connection to the client. This can help in networks where the client does not accept incoming connections.

The client connects from port ( $N$ ) to the server's command port $21$ .
When a file transfer is requested, the client sends PASV over the control channel and asks the server to prepare a data port.
The server selects an available port ( $P$ ), listens there, and returns the address and port in a 227 response, for example '227 Entering Passive Mode (192,168,1,10,192,5)'. The administrator configures the passive port range and the address sent to clients. The client then connects to that port.
The client initiates the data connection from its own port, $N+1$ in this example, to the address and port $P$ specified by the server.

Effect on filtering: The client initiates the data connection, so rules that permit outgoing traffic may make the transfer easier, and NAT can create a mapping for return traffic. The server still needs port $21$ and its configured passive port range to be reachable.

6. Security and alternatives

The original FTP specification does not provide encryption or cryptographic authentication. The username and password are part of the command exchange, while file content uses a data connection. Additional protection is required when transferred data must be confidential.

Plain-text transmission: In standard FTP, the username, password, commands, and file contents are sent without encryption. Someone able to observe traffic between the client and server can read these values and modify a transfer without detection by the protocol itself.
Lack of data integrity: Standard FTP does not define a cryptographic check that would reveal whether a file changed during transfer. The protocol itself therefore does not notify the client or server about such a modification. An additional cryptographic mechanism can verify the transferred content.

Secure FTP solutions

Common protection options include the following:

FTPS (FTP over SSL/TLS): This is FTP extended with TLS and the older Secure Sockets Layer (SSL). TLS can protect the control and data connections, depending on the negotiated configuration. Certificate validation can authenticate the server, while encryption and integrity depend on a correct handshake. FTPS is described by RFC 4217. The client and server must negotiate protection for both the control and data connections. Otherwise file data can remain exposed even when the name FTPS is used. Protecting the control channel alone does not secure an unprotected data channel.
SFTP (SSH File Transfer Protocol): SFTP is not a variant of FTP. It is a separate protocol carried within SSH, usually through one SSH connection and one channel for protocol messages. It does not use FTP commands such as USER and RETR. Packet exchange and authentication are defined by the SSH-based protocol and remain outside the FTP command set. It uses the protection mechanisms supplied by SSH, including confidentiality and integrity, according to the SSH configuration.

FTP remains a useful example of a protocol that separates control and data. For sensitive information, use cryptographic protection such as TLS or SSH and configure both endpoints accordingly.