How FTP Works: Control & Data Channels and Clear-Text Passwords (Animated)

FTP is one of the oldest internet protocols for moving files. It uses two connections: a control channel for commands and a separate data channel for the files. It was designed before security mattered, so everything, including the password, travels in clear text.

1. Connect & log in: commands on the control channel

The client connects to port 21. The server greets it with a numbered reply, and the client logs in with two plain-text commands.

1. 220 (FTP server → Your laptop): The banner reveals the server software and version, useful to an attacker looking for known vulnerabilities.
2. USER (Your laptop → FTP server): The username, as readable text.
3. 331 (FTP server → Your laptop): The server asks for the password.
4. PASS (Your laptop → FTP server): The password crosses the network exactly as typed. Wireshark shows it in the Info column.
5. 230 (FTP server → Your laptop): Logged in.

Wireshark filter:

ftp

2. Passive mode & transfer: a second connection for the file

Files don’t travel on the control channel. In passive mode the server opens an extra port and tells the client to connect to it.

1. PASV (Your laptop → FTP server): The client asks for passive mode.
2. 227 (FTP server → Your laptop): The last two numbers encode the port: 195 × 256 + 80 = 50000.
3. RETR (Your laptop → FTP server): The download command, still on the control channel.
4. FTP-DATA (FTP server → Your laptop): The file itself travels on the second connection, also unencrypted.
5. 226 (FTP server → Your laptop): Done.

Wireshark filter:

ftp-data

3. Password sniffing: attack: just read it

Anyone who can see the traffic, on shared Wi-Fi, a compromised switch or through ARP spoofing, reads the login and the files.

1. PASS (Your laptop → FTP server): The user logs in as usual.
2. SNIFFED (Router → Attacker): One display filter shows the password. If the user reuses it elsewhere, those accounts fall too.

Wireshark filter:

ftp.request.command == "PASS"

4. Use sftp: defence: the same job inside ssh

SFTP transfers files inside an SSH connection: one port, fully encrypted, key-based login. Disable plain FTP and anonymous access.

1. SFTP (Your laptop → FTP server): Login and file travel inside SSH.
2. SNIFFED (Router → Attacker): The sniffer sees nothing useful.

Try it:

sftp priya@files.example
nmap --script ftp-anon -p21 target   (check for anonymous FTP)

FAQ