FTP Modes | Teleinf Edu

1. FTP connections

The File Transfer Protocol (FTP) separates command exchange from data transfer. This distinction explains the difference between Active and Passive modes. A typical FTP session between a client and server uses two types of connections:

The control connection: It is established when an FTP client connects to a server, usually on server port $21$ . It normally remains open for the session. The connection carries client commands such as USER, PASS, LIST, and RETR, together with server replies. Control replies can report the start of a transfer with 150 and its completion with 226. File data and directory listings use a separate channel. The client can end the session with QUIT, while an error or timeout can also close the connection. Port 21 is the service default, not a requirement that prevents another configured port.
The data connection: It is created on demand to transfer file contents during uploads or downloads and directory listings. It closes after the transfer, so another transfer requires a new data connection. The connection can carry binary or text data according to the transmission mode negotiated by the client and server.

Active and Passive FTP differ in how this second, temporary data connection is established. In Active mode the server initiates it, while in Passive mode the client does. The control connection remains open and carries commands and replies related to the transfer. This choice affects how firewalls and Network Address Translation (NAT) handle the session. The server must expose its configured passive range to incoming connections, and the client can use PASV when EPSV is unsupported.

2. Active FTP mode

Active FTP mode is described in the early FTP standards. In this model, the server initiates the data connection to the client. In the classic configuration the server uses source port $20$ , while the client supplies its listening port with PORT. In the classic IPv4 format, the last two PORT fields encode a port as p1*256+p2. For data transfer, it is a "server-connects-to-client" model.

Active-mode connection flow

The sequence of events in Active mode is as follows:

The client computer opens a port (call it $N$ , with $N$ > 1023 in this example) and uses it to initiate the control connection to the FTP server's port $21$ . The session begins with authentication and command exchange.
When the client needs to transfer data, for example after issuing a 'LIST' or 'RETR' command, it selects another port, $N+1$ in this example, and listens for an incoming TCP connection there.
The client then informs the server of which port it is listening on by sending the 'PORT' command over the existing control connection. The 'PORT' command includes the client's IP address and the chosen port number, formatted as six comma-separated values. For a client with IP address $192.168.1.100$ listening on port $5200$ ( $5200 = 20*256 + 80$ ), the command would be:
```
PORT 192,168,1,100,20,80
```
The server receives the 'PORT' command, acknowledges it, and initiates a TCP connection to the supplied address and port ( $192.168.1.100$ and $5200$ ). In the classic configuration, its source port is $20$ ; a deployment can use another source port by configuration.
Once this data connection is established, the file or directory listing is transferred. After the transfer is complete, the server closes the data connection. The control connection on port $21$ remains open so the client can issue another command or end the session.

Active-mode limitations

A server-initiated connection can be harder to establish in networks that filter traffic or use NAT. If the client has a public address and an allowing rule, Active mode can work without those limitations. The main causes of problems are:

Firewalls: Firewall rules can block the server's incoming connection to the client's port ( $N+1$ ). Packets may then be dropped and the transfer may end with an error or timeout. The result depends on firewall rules and connection tracking.
Network Address Translation (NAT): A client may have a private IP address, for example in the $192.168.x.x$ range, and send it in the 'PORT' command. Such an address is not routable on the public internet, so the connection may not reach the client. Some devices with an Application Layer Gateway (ALG) inspect FTP and modify the address or translation rules, but their behavior depends on configuration and implementation.

Active mode can therefore require additional configuration on the client, server, or intervening devices.

3. Passive FTP mode (PASV)

Passive mode, identified by the PASV command, moves initiation of the data connection from the server to the client. The server opens a listening port and returns it in a 227 response. The client then initiates both the control and data connections, which often makes client-side traffic filtering easier to handle.

Passive-mode connection flow

The sequence of events in Passive mode is:

The client computer opens a port ( $N$ ) and uses it to initiate the control connection to the FTP server's port $21$ , just as in Active mode.
When the client needs to transfer data, instead of opening a port to listen on, it sends the 'PASV' command to the server over the control connection. This command is a request for the server to prepare for a data connection.
The server receives the 'PASV' command, selects an available port on its machine (call it $P$ ), and listens there for the data connection. The range of such ports is normally set in the server configuration.
The server returns an address and the selected port ( $P$ ) in response to 'PASV'. The response begins with code '227' and contains address information in a format similar to the 'PORT' command. NAT or an intervening device may rewrite the address. For a server at $203.0.113.50$ opening port $49157$ ( $49157 = 192*256 + 5$ ), the response would be:
```
227 Entering Passive Mode (203,0,113,50,192,5)
```
The client receives the response, parses the address and port, and initiates a new TCP connection from its own port, $N+1$ in this example, to the address and port specified by the server.
Once this data connection is established, the file or directory listing is transferred. After completion, the client closes the data connection. The control connection remains open and can carry control replies.

Passive-mode configuration and limitations

Moving connection initiation reduces the effect of some client-side firewall and NAT rules, but it requires server-side configuration. The server must expose an address and port reachable by the client and allow connections in the selected range.

NAT traversal: The client initiates both connections, so the NAT device can create mappings for outgoing and return traffic. The result depends on the device configuration and on the address supplied in the PASV response.
Client firewall compatibility: Both connections are initiated by the client, so rules that permit outgoing traffic may allow the transfer. A firewall can still filter traffic by address, port, or application policy.
Server-side configuration: The administrator must allow incoming connections on port $21$ and in the configured range used for passive data connections, for example $50000$ - $51000$ .

Passive mode is often selected when the client does not accept unexpected incoming connections. The choice still depends on both endpoints and intervening devices.

4. Comparison Summary: Active vs. Passive FTP

Feature	Active Mode	Passive Mode
Who initiates the Data Connection?	The Server	The Client
Server's Data Port	Usually port $20$ (source)	Port selected by the server, for example $P$ (destination)
Client-side Firewall Issue	Possible. The firewall may block an incoming connection.	Often lower. The client initiates the connection.
NAT Issue	Possible. The address in PORT may be unreachable.	Depends on the PASV address and NAT configuration.
Server-side Firewall Configuration	Allow port $21$ and the required traffic to the client.	Allow port $21$ and the configured passive port range.
Modern Usage	Requires the client to accept the connection.	Often fits client-side filtering better.

5. Extended Passive mode (EPSV)

The original 'PORT' and 'PASV' commands carry an address and port in a six-field format intended for IPv4. That format does not describe IPv6 addresses. RFC 2428 defines EPRT and EPSV extensions for IPv6 and other network protocols. EPSV reduces the address information returned by the server, which simplifies handling of the control and data connections.

The 'EPSV' command:A client can use 'EPSV' instead of 'PASV' to ask the server to prepare a data port without carrying an IPv4-formatted address. The extension can work with IPv4 and IPv6 when both sides support it.
The 'EPSV' response: The server supplies only a port number. The client connects to the address used for the control connection, and the port is delimited by characters selected in the response. The response uses code 229 and does not require the server to send an IPv4 address.
```
229 Entering Extended Passive Mode (|||49157|)
```
The '|||' characters are delimiters, and '49157' is the TCP port to which the client should connect.
Benefits:The response does not carry an IPv4 address and can be used with IPv4 or IPv6. The order of attempts depends on client and server capabilities. The extension's behavior still depends on support at both endpoints. An EPSV response does not carry an IPv4 address encoded in six fields. The corresponding 'EPRT' command extends Active mode, but it still requires a server-initiated connection, so firewall rules can remain relevant. EPSV can also reduce problems caused by rewriting the address returned in a PASV response. Neither extension changes the separation between the control and data connections. During transfer, commands and replies still use the control connection, while the data channel remains temporary.