Active and passive FTP
Active FTP
See how PORT tells the server where to open the next data connection back to the client.
In active mode, you tell the server where to connect back for file bytes. You listen locally, send PORT with your address and port, then the server opens the data connection to you.
That made sense when clients sat on the public Internet. It breaks behind home NAT or a laptop firewall that blocks inbound TCP.
You still opened the control connection to port 21 yourself. Login can work while every transfer dies with 425:
ftp> passive off
Passive mode off.
ftp> get report.csv
425 Can't open data connectionThe server tried to reach the address you advertised in PORT and could not. I see this a lot on hotel Wi-Fi and corporate laptops.
Try passive mode on those networks first. Active mode is a debugging tool for me, not a default.
Classic PORT encodes the endpoint in six numbers:
PORT 192,0,2,44,195,80
200 PORT command successful
RETR report.csv
150 Opening data connection
226 Transfer completeThe port is 195 * 256 + 80, which is 50000. The server connects to 192.0.2.44:50000.
That address must be reachable from the server. NAT often makes you advertise a private IP the server cannot dial.
Servers should reject PORT targets that point at other hosts. Otherwise someone can abuse your FTP server as a relay in a bounce attack.
Most people stay in passive mode today. Active mode is still worth knowing when you read old logs or a partner insists on it.
On a home network you may need to forward a small port range to your laptop for active mode to work at all. I usually do not bother.
Trace one active transfer on a test network. Note the advertised client IP, the server’s outbound connect attempt, and the final reply.
Lesson completed