What is the difference between active and passive FTP?

The primary distinction between Active FTP and Passive FTP lies in how data connections are established, which impacts their compatibility with firewalls and NAT devices.

Active FTP (Active FTP)

In active mode, the client connects to the FTP server's command port (port 21) from a random high-numbered port (above 1023). After the connection is established, the client listens on a randomly selected port and notifies the server via the command channel, requesting the server to initiate a connection from port 20 (the FTP server's data port) to this port. Upon receiving this port number, the server initiates a connection from port 20 to the specified client port.

Example:

1. The client connects to port 21 of the server.
2. The client selects a random port (e.g., 5001) and informs the server.
3. The FTP server connects from port 20 to the client's port 5001.

Passive FTP (Passive FTP)

In passive mode, the client still connects to the server's command port (port 21) from a random high-numbered port. However, the method of establishing data connections differs: the client sends a PASV command to the server, which responds by selecting a random port, notifying the client, and listening on that port. Upon receiving the port number, the client initiates a connection from another random port to the server's random port.

Example:

1. The client connects to port 21 of the server.
2. The client sends a PASV command to the FTP server.
3. The server selects a random port (e.g., 5010) and notifies the client.
4. The client connects from another random port (e.g., 5002) to the server's port 5010.

Key Differences Summary

• Firewall and NAT Friendliness: Passive FTP is generally more suitable for clients located behind firewalls or NAT devices, as it allows the client to establish two outbound connections, eliminating the need for the server to initiate inbound connections.
• Initiator of Data Connections: In active mode, the server initiates data connections to the client. In passive mode, the client initiates all connections.

In practice, Passive FTP is more commonly used due to its higher compatibility and ability to traverse modern firewalls.