Skip to main content
protocols.pageprotocols.page
21

Port 21 – FTP

TCP

Port 21 is the FTP control port. The client connects to port 21 to issue FTP commands (USER, PASS, LIST, RETR). Data transfer uses a separate connection on port 20 (active mode) or a random client port (passive mode). FTP is unencrypted – SFTP (port 22) or FTPS should be used instead.

Port Number

21

Protocol

TCP

Service

File Transfer Protocol

Range

IANA Well-Known (0–1023)

Description

FTP uses two channels: the command channel on port 21 and the data channel on port 20. Port 21 handles authentication and command exchange while actual file transfers use the data channel. Due to cleartext transmission of credentials, FTP should only be used on trusted networks or replaced with SFTP.

Security risks

  • 1Credentials transmitted in cleartext – any network observer (tcpdump, Wireshark) captures username and password on the wire. Never use FTP over untrusted networks.
  • 2Anonymous FTP misconfiguration allows unauthorized file uploads. Attackers deposit malware or use the server as a warez distribution point. Disable anonymous write access.
  • 3FTP bounce attacks (PORT command abuse) enable port scanning through the FTP server. Modern servers disable this by default but legacy vsftpd/ProFTPD configs may still allow it.
  • 4Active mode FTP requires the server to connect BACK to the client on a random port – impossible through most firewalls. Use passive mode (PASV) with a defined port range.

Firewall guidance

Block port 21 inbound unless you explicitly run an FTP server for legacy clients. If FTP is required, restrict source IPs and use FTPS (explicit TLS on port 21 via AUTH TLS) or move to SFTP on port 22. For passive mode, open a narrow port range (e.g., 50000-50100) rather than all high ports.

Diagnosis commands

Detect FTP server version and whether anonymous login is allowed

shell
nmap -sV -p 21 target

Test anonymous FTP access

shell
curl -v ftp://host/ --user anonymous:[email protected]

Test STARTTLS (explicit FTPS) support on port 21

shell
openssl s_client -connect host:21 -starttls ftp

Usage examples

Port 21 – FTP
shell
ftp ftp.example.com
lftp -u user ftp.example.com

Common services on this port

vsftpdProFTPDPure-FTPdFileZilla ServerIIS FTPWS_FTP

Related ports

22

SSH/SFTP (encrypted replacement)

990

FTPS control (implicit TLS)

989

FTPS data (implicit TLS)

History

FTP was defined in RFC 114 (1971), making it one of the oldest internet protocols still in use. RFC 959 (1985) standardized the modern version. SFTP (SSH-based, 1997) and FTPS (TLS-based, RFC 4217, 2005) are the secure replacements.

FAQ

Should I use FTP, FTPS, or SFTP?

Use SFTP (port 22) for all new deployments – single port, encrypted, key-based auth. FTPS only if you must support legacy FTP clients. Never use plain FTP over untrusted networks.

Why does FTP need two ports?

FTP separates control (commands on port 21) from data (file transfers on port 20 or random high ports). This dual-channel design predates firewalls and causes NAT/firewall traversal issues that SFTP avoids entirely.