FTP (1) Communication connection principle

1. FTP service description

Ftp (File Transfer Protocol), the file transfer protocol, is one of the older services of the Internet. It is a set of standard protocols for file transfer on the network, using client / server mode. It belongs to the application layer of the network transport protocol.

II. FTP service operation mode

FTP services generally run on both tcp 20 (data transfer) and tcp 21 (communication signal establishment control) ports by default. Port 20 is used to transmit data streams between the client and server, while port 21 is used to transmit control flows.

1. There are two modes for ftp server to run, namely, active mode and passive mode, as shown in the following figure:

Ftp on the left side of the figure is in active mode. The client first establishes a communication connection with ftp port 21, and then negotiates a port with the client to accept data (the client randomly opens a port). After successful negotiation, the ftp server actively pushes data from port 20 to this random port of the client; data transmission is completed.

In the ftp processing device on the right, the client also establishes a communication connection with the ftp21 port, and then tells the client that its data port is 20 (default, can be customized). When the client learns that the server is processing in passive mode and the passive data is open, the client will use its own random port to connect to the server's data port 20 to obtain data. Server card passively puts data state

The difference between active mode and passive mode is whether the data is actively pushed to the client or passively waiting for the client to pick it up.

2. Analysis and explanation

Active mode because the data is actively pushed to the random negotiation port of the client, and because there is a firewall when the enterprise or client accesses the Internet server (to prevent external access), when ftp is in active mode, unless local and local firewall allows, otherwise ftp will be blocked by firewall, resulting in unable to complete data transmission! As a result, there is a passive mode, the general firewall prevents the outside from coming in but not the inside out, so in passive mode, the client can go out and access port 21 20, even if the data transmission port 20 is changed, it is fixed, and the client firewall can be fixed. Unlike in the active case, the data received by the client is random ~

III. Ftp security issues

The ftp protocol is relatively old, and the data is transmitted in plaintext by default. The connection account and password of ftp can be seen by grabbing a packet, which is quite insecure, so it is best to use ssl + ftp to improve the security of ftp.