File Transfer Protocol
File Transfer Protocol
The File Transfer Protocol (FTP) is a standard network protocol used for transferring computer files between a client and a server on a computer network. It is built on a client-server model architecture and uses separate control and data connections between the client and the server. FTP is defined by RFC 959 and was first published in 1985.
FTP users may authenticate themselves using a clear-text sign-in protocol, normally in the form of a username and password, but can connect anonymously if the server is configured to allow it. For secure transmission that protects the username and password, and encrypts the content, FTP is often secured with SSL/TLS (FTPS) or replaced with SSH File Transfer Protocol (SFTP).
History
The original specification for the File Transfer Protocol was written by Abhay Bhushan and published as RFC 114 on 10 April 1971. Later revisions led to RFC 265 (1971), RFC 281 (1971), and RFC 542 (1973). The current standard, RFC 959, was published in October 1985, superseding earlier versions. Several subsequent RFCs have added extensions, such as RFC 2228 (security extensions) and RFC 2640 (internationalization of filenames).
Technical overview
FTP runs over the Transmission Control Protocol (TCP) and typically uses two ports: port 21 for control commands and port 20 for data transfer (in active mode). In active mode, the server initiates a data connection back to the client. In passive mode (PASV), the client initiates all connections, which is often necessary when the client is behind a firewall or network address translator.
The protocol supports both binary and ASCII transfer modes, as well as a variety of commands such as USER, PASS, LIST, RETR, STOR, and QUIT.
Security concerns
Standard FTP is inherently insecure because it transmits authentication credentials and file contents in cleartext. This exposes it to packet sniffing, spoofing, and brute-force attacks. To address these vulnerabilities, secure variants such as FTPS (FTP over SSL/TLS) and SFTP (an entirely different protocol running over SSH) were developed. Many modern environments have deprecated plain FTP in favor of these secure alternatives.