First, the client connects to
the server port 21. This is called the “command port.” It strictly issues
commands (log this user in, show me this directory, store this filename, et al.).
A second connection is also made (with some random port) called the “data port.” This is where
active and passive modes come into play.
By design, in either
transmission mode, an FTP server works with the client to determine a port. The
port is randomly chosen by the client and can be any port greater than 1023. The "standard" data port for active transmissions is 20, but in most cases the port chosen is not standard.
The difference between active
and passive is the way the data port's transmission is treated:
In an active session, the server establishes a connection to the client through the data port.
In a passive session, the client establishes a connection to the server through the data port.
Following the above, active
sessions are sometimes problematic due to firewall reasons. Firewalls have
to be told explicitly to allow a connection from outside your network
(the FTP server, in this case) back in. Remember from above that active
sessions require the server to connect to the client on
some arbitrary data port.
In contrast, passive
connections are often less troublesome because internal firewalls allow
traffic to pass out of your network without issue.
To illustrate the difference, here's an excerpt using FileZilla where you can see how the two are different. Note, I've changed the addresses to fake ones.
In both cases, the command port
is 21 (seen in blue).
The data port (yellow) is shown
in the parenthesis.
Active
Status:
Resolving address of ftp.somesite.com
Status:
Connecting to 66.55.44.33:21...
Status:
Connection established, waiting for welcome message...
Response:
220 Website FTP Server Ready
Command:
USER joesmith
Response:
331 Password required for
joesmith
.
Command:
PASS ********
Response:
230 User joesmith logged in.
Status:
Connected
Status:
Starting upload of somefile.txt
Command:
CWD /
Response:
250 CWD command successful.
Command:
TYPE A
Response:
200 Type set to A
Command:
PORT 192,168,1,101,88,78
Response:
200 PORT command successful
Command:
STOR somefile.txt
Response:
150 Opening ASCII mode data connection for somefile.txt
Response:
226 Transfer complete.
Status:
File transfer successful, transferred 500 bytes in 1 second
For our active example, a PORT command is issued (through the command port, ie, 21) that tells the server where to connect back.
The PORT command consists of six values. The first four values (192,168,1,101) are the IP address of
the client and the last two values (88,78) are the port for the data connection on the client passed to the server (port derived generically by the formula value1 * 256 + value2).
Reminder: Active connections tell the server to connect to the client through the data port, so the server will attempt to connect through a firewall to the client machine.
Passive
Status:
Resolving address of
ftp.somesite.com
Status:
Connecting to 66.55.44.33:21...
Status:
Connection established, waiting for welcome message...
Response:
220 Website FTP Server Ready
Command:
USER joesmith
Response:
331 Password required for joesmith.
Command:
PASS ********
Response:
230 User joesmith logged in.
Status:
Connected
Status:
Starting upload of somefile.txt
Command:
CWD /
Response:
250 CWD command successful.
Command:
TYPE A
Response:
200 Type set to A
Command:
PASV
Response:
227 Entering Passive Mode (66,55,4433,174,109)
Command:
STOR somefile.txt
Response:
150 Opening ASCII mode data connection for somefile.txt
Response:
226 Transfer complete.
Status:
File transfer successful, transferred 500 bytes in 1 second
For our passive example, the PASV command is issued (through the command port, ie, 21). This command tells the server that the client will reach out to the server on some port.
The server's response has six values. The first four values (66,55,44,33) are the IP address of the server and the last two values (174,109) are used by the client to connect to the server on the data port. (Again, the port is derived generically by the formula value1 * 256 + value2).
So, the math works out like this:
Data port for active was 22606 =
(88*256 +78)
Data port for passive was 44653
= (174*256 +109)
There is no way to know ahead of
time which port the client will choose to share with the FTP server in either
transmission mode, but the way traffic flows through the firewall is generally
the culprit when transfers fail.
Your mileage may vary.
No comments:
Post a Comment