Overview
Definition
FTP (File Transfer Protocol): standard network protocol for transferring files between client and server over TCP/IP.
History
Developed: 1971 by Abhay Bhushan (RFC 114). Updated: RFC 959 (1985) current standard.
Purpose
Purpose: upload, download, manage files remotely. Application layer protocol, operates over TCP ports 20 and 21.
Architecture
Client-Server Model
FTP uses client-server architecture: client initiates connection, server responds and manages files.
Control Connection
Control connection: persistent TCP connection on port 21. Carries commands and replies. Text-based.
Data Connection
Data connection: separate TCP connection for transferring file data. Dynamic port allocation.
Connection Types
Control Connection
Established at session start. Maintained until session ends. Transmits commands/responses only.
Data Connection
Opened and closed per transfer. Supports file data, directory listings.
Port Numbers
Control: TCP port 21. Data: TCP port 20 (active mode) or arbitrary port (passive mode).
Commands and Responses
Command Structure
Commands: ASCII text, 3-4 letter codes, optional parameters. Example: USER, PASS, RETR.
Response Codes
Replies: 3-digit codes, first digit classifies response. Example: 2xx success, 5xx error.
Common Commands
USER: specify username. PASS: password. LIST: directory listing. RETR: retrieve file. STOR: store file.
Modes of Operation
Active Mode
Client opens random port, sends PORT command to server. Server initiates data connection from port 20 to client port.
Passive Mode
Client sends PASV command. Server opens arbitrary port, replies with port info. Client initiates data connection.
Use Cases
Active mode: legacy networks. Passive mode: behind NAT/firewalls, preferred for client accessibility.
Authentication
Username and Password
Authentication: USER and PASS commands. Plaintext transmission, vulnerable without encryption.
Anonymous FTP
Anonymous login: username "anonymous," password usually email. Used for public file sharing.
Security Implications
FTP lacks encryption natively. Credentials and data exposed to sniffing without TLS/SSL extensions.
Data Transfer Modes
Stream Mode
Default mode: data sent as continuous byte stream. No formatting or buffering.
Block Mode
Data sent in blocks with headers. Supports error checking and restart markers.
Compressed Mode
Data compressed using algorithms to reduce bandwidth. Rarely implemented.
Security Considerations
Vulnerabilities
Plaintext credentials, data interception, man-in-the-middle attacks.
FTP over SSL/TLS (FTPS)
FTPS adds encryption layer. Uses SSL/TLS for control and optionally data connections.
SSH File Transfer Protocol (SFTP)
Distinct protocol using SSH for encrypted transfers. Not FTP-based but alternative.
FTP Extensions
RFC 2389 - Feature Negotiation
Allows client to query server-supported options via FEAT command.
RFC 3659 - Extensions for File System Interaction
Adds commands for MLST, MLSD: machine-readable directory listings.
Other Extensions
UTF-8 support, extensions for IPv6, enhanced security mechanisms.
Comparison with Other Protocols
FTP vs HTTP
FTP optimized for bulk file transfers. HTTP primarily for hypertext, supports partial downloads.
FTP vs SFTP
FTP lacks encryption; SFTP provides secure, SSH-based file transfer.
FTP vs SCP
SCP simpler, secure copy over SSH; FTP more feature-rich but less secure.
Common Uses
Website Maintenance
Uploading web files to servers. Updating content, scripts, media.
Data Sharing
Distributing large files, software, patches, public archives.
Backup and Synchronization
Transferring backups between systems, synchronizing remote directories.
Limitations
Security Risks
Inherent lack of encryption. Requires extensions or alternatives for secure transfer.
Firewall/NAT Challenges
Active mode problematic behind NAT/firewall. Passive mode preferred but not universally supported.
Complexity
Two separate connections complicate networking setup and programming.
References
- Abhay Bhushan, "RFC 114: A File Transfer Protocol," Network Working Group, 1971, pp. 1-22.
- Postel, J., Reynolds, J., "RFC 959: File Transfer Protocol (FTP)," IETF, 1985, pp. 1-62.
- Allison Mankin et al., "RFC 2389: Feature Negotiation Mechanism for FTP," IETF, 1998, pp. 1-7.
- Klensin, J., "RFC 3659: Extensions to FTP," IETF, 2003, pp. 1-52.
- Ylonen, T., Lonvick, C., "The Secure Shell (SSH) Protocol Architecture," RFC 4251, IETF, 2006, pp. 1-14.
| FTP Command | Function | Example |
|---|---|---|
| USER | Send username | USER anonymous |
| PASS | Send password | PASS user@example.com |
| RETR | Retrieve file | RETR file.txt |
| STOR | Store file | STOR newfile.txt |
| LIST | Directory listing | LIST /pub |
| FTP Response Code | Meaning | Example |
|---|---|---|
| 1xx | Positive Preliminary reply | 150 File status okay |
| 2xx | Positive Completion reply | 226 Closing data connection |
| 3xx | Positive Intermediate reply | 331 User name okay, need password |
| 4xx | Transient Negative Completion | 421 Service not available |
| 5xx | Permanent Negative Completion | 530 Not logged in |
Active Mode Connection Setup:1. Client connects to server port 21 (control connection).2. Client opens random port N>1023.3. Client sends PORT N command to server.4. Server initiates data connection from its port 20 to client's port N.5. Data transfer occurs over this connection.6. Connection closes after transfer.Passive Mode Connection Setup:1. Client connects to server port 21 (control connection).2. Client sends PASV command.3. Server opens random port P>1023.4. Server replies with IP and port P.5. Client initiates connection from random port to server port P.6. Data transfer occurs.7. Connection closes after transfer.FTP Command/Response Example:C: USER anonymousS: 331 User name okay, need password.C: PASS user@example.comS: 230 User logged in, proceed.C: PASVS: 227 Entering Passive Mode (192,168,1,2,195,80).C: LISTS: 150 Opening ASCII mode data connection.S: [Data Connection Transfers Directory List]S: 226 Transfer complete.