Control and data connections

Every FTP session uses two kinds of TCP connections, and most troubleshooting starts there.

The control connection stays open for the whole session. You send commands on it and read replies. It normally hits the server on TCP port 21.

Data connections carry directory listings and file bytes. The server opens a fresh one for each listing or transfer, then closes it when the bytes are done.

That separation keeps commands responsive while large files move. It also means one listing is never just one TCP connection. When someone says “FTP connects but won’t list files,” I ask about the data port before I ask about passwords.

Wireshark helps here. Filter on the passive port from EPSV and see whether the SYN ever completes. No SYN means firewall or wrong advertised IP. That narrows the ticket to network, not credentials.

One listing uses both channels:

sequenceDiagram
  accTitle: FTP control and data connections
  accDescr: The client requests passive mode on the control connection, opens a separate data connection for the listing, reads its bytes, then waits for the final completion reply on the control connection.
  participant Client
  participant Control as Server port 21
  participant Data as Server port 50021

  Client->>Control: EPSV
  Control-->>Client: 229 passive port 50021
  Client->>Data: Open data connection
  Client->>Control: MLSD
  Control-->>Client: 150 opening data connection
  Data-->>Client: Directory facts, then EOF
  Control-->>Client: 226 transfer complete

Here is the same idea as typed commands:

ftp> epsv
229 Entering Extended Passive Mode (|||50021|)
ftp> mlsd
150 Opening data connection
226 Transfer complete

The data connection has no FTP commands of its own. Its bytes mean whatever the control command asked for.

Closing the data socket is not success by itself. You still need 226 on the control connection. The server can receive every byte and then report a disk error.

If login works but a listing hangs, the control connection is probably fine. Check whether the client ever opened the data port. Firewalls often allow port 21 and block the passive range.

Draw the two TCP connections for the exchange above. Label who opens each one and which reply proves completion.