Knowledge Base

1. Home

Article 54

File Transfer Protocol (FTP)

File Transfer Protocol (FTP) is an application-layer protocol for transferring files between a client and a server over TCP. FTP also provides commands for authentication, navigating directories, listing files, renaming and deleting files, and managing transfer settings.

How FTP works

An FTP session uses separate connections for commands and file data:

• The control connection, normally established to TCP port 21, carries FTP commands and server replies. It usually remains open for the entire session.
• A data connection is created when directory listings or files are transferred. Depending on the selected transfer mode, either the server or the client accepts this connection.

Active and passive mode

In active mode, the client tells the server where to establish the data connection. In passive mode, the server supplies an address and port and the client establishes the data connection. Passive mode is generally easier to use when the client is behind a firewall or NAT router. See Passive Mode vs. Active Mode for a detailed explanation.

Security

Traditional FTP does not encrypt credentials, commands, or transferred data. FTP can be secured with TLS as described by RFC 4217; this protocol is commonly called FTPS. SFTP is a different file-transfer protocol that operates over SSH and is not FTP.

Specifications and references

• RFC 959: File Transfer Protocol — the base FTP specification.
• RFC 1123: Requirements for Internet Hosts — Application and Support — includes clarifications and requirements for FTP implementations.
• RFC 2428: FTP Extensions for IPv6 and NATs — defines the EPRT and EPSV commands.
• RFC 2577: FTP Security Considerations — discusses common FTP security issues and mitigations.
• RFC 3659: Extensions to FTP — defines features including machine-readable directory listings with MLST and MLSD.
• RFC 4217: Securing FTP with TLS — specifies FTP over TLS (FTPS).
• IANA FTP Commands and Extensions Registry — the current registry of FTP commands and extensions.