Active and passive FTP
EPRT and EPSV
Use the extended active and passive commands designed for IPv6 and simpler address handling.
Classic PORT and PASV embed IPv4 addresses in awkward six-number forms. EPRT and EPSV replace that with a clearer format, especially for IPv6 and for NAT headaches.
When a passive reply contains 10.0.0.8 but the client is on the public Internet, classic PASV breaks. EPSV returns only a port so the client reconnects to the same host it used for login. That fixes a lot of cloud VM misconfigs.
If EPSV fails with 502, fall back to fixed PASV only after you fix the advertised public address. Do not chase both at once. Fix the NAT mapping first, then retest.
EPSV is the one you will see most:
ftp> epsv
229 Entering Extended Passive Mode (|||50003|)
ftp> get report.csv
150 Opening data connection
226 Transfer completeThere is no embedded address for NAT to rewrite badly. When a partner says “use extended passive,” this is what they mean.
Extended active mode names the address family explicitly:
EPRT |2|2001:db8::44|50002|
200 EPRT command successful
RETR report.csv
150 Opening data connection
226 Transfer completeThe client picks the delimiter. 2 means IPv6, then the address, then the TCP port. IPv4 extended active uses protocol 1 in the same format.
If the server does not support a family, it may answer 522 and list what it does support. Read that reply. Do not treat a failed EPRT as if it were a valid endpoint.
When both sides support it, I prefer EPSV over classic PASV on dual-stack hosts. You skip stale addresses inside the reply text.
Older IPv4-only boxes still speak PORT and PASV. Know both so you can read verbose logs from legacy gear.
Write the connection tuple for each example above and mark who opens the data connection.
Lesson completed