FTP
File Transfer ProtocolFTP is older than almost everything else here. Unusually, it uses one connection for commands and a second for each file, sends its commands as readable text — and sends the password that way too, which is why it has been steadily replaced.
FTP splits commands and data onto separate connections — an elegant idea in 1971 that is now a firewall headache and a plaintext password.
Open the FTP lab →
Port 21 carries the conversation, not the file. Watch the second connection get negotiated, then see why a server-initiated active-mode connection is commonly blocked by NAT or a firewall.
How it works
In passive mode the client opens both connections, which is what lets FTP work from behind NAT. In the older active mode the server connects back to the client — and almost every firewall now refuses that.
What FTP does, step by step
The client connects to port 21 and logs in with USER and PASS — in clear text unless FTPS is in use.
PASV (or the old PORT) settles which side opens the second connection and on which port.
RETR, STOR or LIST runs over the fresh data connection, which closes when the transfer ends.
The control connection stays open for the next command; QUIT ends the session.
In cybersecurity
FTP was designed for a network where nobody was listening. Credentials and data both cross in the clear, and the second connection defeats simple firewalling.
USER and PASS are readable to anyone on the path — this alone disqualifies it.
The file itself is unencrypted, so confidentiality and integrity are both absent.
The dynamic second port needs a protocol helper to inspect the control channel and open it.
The old PORT command could make a server open connections to a third party — port scanning by proxy.
Writable anonymous servers became distribution points for whatever anyone uploaded.
Either encrypts credentials and content; SFTP also needs only one port.