FTP

FTP (File Transfer Protocol)

1. Definition

FTP (RFC 959) is an application-layer protocol for transferring files between a client and a server over TCP. It is the standard mechanism for uploading/downloading web pages and files to/from a web server (e.g. publishing a site to the docroot).

Property	Value
Transport	TCP, connection-oriented, reliable
Ports	21 — control connection; 20 — data connection (active mode)
Model	Client–server, two separate connections (out-of-band control)
Authentication	Username + password (anonymous FTP uses `anonymous` + e-mail)
Statefulness	FTP is stateful — server keeps working directory, type, mode per session

2. Two-Connection Architecture

   CLIENT                                   SERVER
  +-------------+  control (port 21)  +----------------+
  |   FTP CLI   |<===================>|  server-PI     |  commands/replies,
  |             |   USER,PASS,PWD,LIST|                |  stay open all session
  |             |                     +----------------+
  |             |  data (port 20 active / random passive)   
  |             |<===================>|  data transfer  |
  +-------------+  RETR,STOR          +----------------+

Control connection (21): carries commands (USER, PASS, PORT, PASV, LIST, RETR, STOR, CWD, QUIT) and numeric replies (220 ready, 331 password, 226 transfer complete, 530 not logged in). Remains open for the whole session.
Data connection: opened per file/listing and closed after each transfer.

3. Active vs Passive Mode

Mode	Who opens the data connection	NAT/firewall friendliness
Active (PORT)	Server connects back to the client's port 20 from port 20	Problematic behind client-side firewalls/NAT (client port unreachable)
Passive (PASV)	Client connects to a random high port the server opened	NAT-friendly (default in modern clients)

4. Transfer Modes & Types

ASCII mode — text conversion (line-ending translation); Binary (image) mode — byte-for-byte copy (images, archives, executables) — use binary for anything non-text.
Structure: file / record / page; transmission modes: stream, block, compressed.

5. Typical Session

 ftp ftp.abc.com
 Connected ... 220 Welcome
 Name: student           -> USER student
 Password:               -> PASS ****        (331/230)
 ftp> pwd                -> 257 "/home/student"
 ftp> binary             -> 200 TYPE I
 ftp> put index.html     -> STOR index.html  -> 226 Transfer complete
 ftp> get report.zip     -> RETR report.zip  -> 226 Transfer complete
 ftp> quit               -> 221 Goodbye

6. Security Concerns and Secure Alternatives

FTP weaknesses: credentials and data are transmitted in clear text (sniffable), no integrity check, vulnerable to brute-force and bounce (PORT) attacks.

Secure alternative	Basis
FTPS (FTP Secure)	FTP + TLS/SSL (explicit `AUTH TLS` or implicit port 990)
SFTP	SSH File Transfer Protocol — one encrypted connection over SSH (port 22)
scp / rsync over SSH	Encrypted copy/sync

7. FTP vs HTTP

Aspect	FTP	HTTP
Purpose	File transfer (upload/download)	Resource/document retrieval
Connections	Two (control + data)	One (request/response)
State	Stateful	Stateless
Auth	User/password login	Usually none (or via headers)
Ports	21 / 20 (or passive)	80 / 443
Encryption	None (needs FTPS/SFTP)	HTTPS/TLS

8. Exam Points

Explain FTP architecture with control and data connections (diagram) — 10 marks (very frequent).
Explain active vs passive mode with the port handshake — 5-7 marks.
Why is FTP stateful while HTTP is stateless? — 5 marks.
Short note: FTP security issues and secure alternatives (FTPS/SFTP) — 5 marks.