FTP active mode is based on TCP,
a reliable layer-4 protocol frequently used in data communications.
Achieving reliable transport requires acknowledgements,
sequencing, and more low-level details unrelated to FTP.
I don't want to get bogged down in TCP chatter, so I'm not depicting it here.
For now, just know that FTP control communications occur on TCP port 21.
Let's begin with a high-level FTP login process.
The client sends the FTP user command along with the username itself,
which is ftpuser in this example.
Traffic is sent to the server with destination port 21.
The server replies in true TCP fashion by swapping the
source and destination port numbers.
In its reply, the server asks for the password.
All of this occurs in plain text, by the way,
providing no confidentiality from intermediate packet snooping.
The client supplies the password using the FTP PASS
command and the password itself, ftppass in this example.
Clearly this is a huge security flaw we will address later in this course,
but for now, let's continue examining the message types.
This slide contains the real meat and potatoes of FTP active mode.
After a login, the FTP client sends the port command to the FTP server.
This contains the TCP port that the client is listening on.
In this case, port 46197 is used.
Why would the client need to tell the server that it is
listening on a random TCP ephemeral port?
Keep watching.
Next, since the client is downloading a file,
it issues the RETR command, meaning retrieve,
requesting a specific file.
In this case, the client is asking for R1.cfg from the server.
At this point,
you might think the server just responds with a file with some reply
traffic sourced from port 21 and destined to port 41138.
Not so.
Instead,
the server initiates a new TCP session to the client using a
source port of 20 and a destination port of 46197.
How did the server come up with this destination port?
The server learned this from the client's port command,
which says, when we transfer files, initiate a session to me on port 46197.
The source port of 20 is used for FTP data traffic as port 21 is
used exclusively for FTP signaling messages.
Once the transfer is complete,
some additional but relatively uninteresting cleanup
signaling occurs to close the session.
FTP can also be used to upload files.
That is to say, files can be sent from client to server.
In that case,
the client still has to send the port command via the signaling channel.
Again, this is the client saying I'm listening on port 44667,
and you should connect to this when I tell you I'm ready to send the file.
The client uses the STOR command called STOR,
which is used behind the scenes to execute a put operation.
The client specifies the name of the file to upload,
which is R3.cfg in this case.
Notice that both the port and store commands are
destined to the server on TCP port 21, as they are signaling messages.
The server then opens a new FTP data session to the client
using the basic TCP three-way handshake,
which is not shown for cleanliness.
Once that session is up, the client sends the file upstream to the server.
It's important to note that regardless of the direction of file transfer, the direction of FTP data channel establishment is always server to client.