Post by Joseph HuberPost by AlderPost by Joseph HuberWhich VMS and TCPIP versions ?
The FTP servers I have access to at the moment are HGFTP 3.1 and the one
included in HP TCP/IP Services 5.4.
I don't claim to know much about the protocol, but
-since nobody else answered-
my understanding of the Passive FTP mode is, that the data transfer
goes over the same socket as the command transfer,
i.e. the FTP server does not open another port for the data.
That understanding is not correct. Note that there is a distinction
between port and socket. A socket is an interface associated
with an end to end connection. That connection is uniquely identified
by a four-tuple: source IP, dest IP, source port, dest port.
Regardless of whether you are using passive or active mode FTP, the
server _ALWAYS_ uses a different socket for the data transfer. It
_NEVER_ uses the control connection.
With active mode FTP, the server allocates a fresh socket data
structure and uses source port 20 (or one less than the port on
which it accepted the control connection if that was on something
other than port 21) and whatever destination port the client
told it to use in its PORT command. It attempts to open
an outbound connection using that socket. (Some software may
use a random high port as the source of the non-passive mode
data connection. Not all firewalls tolerate this misbehavior well).
With passive mode FTP, the server allocates a fresh socket
data structure and an ephemeral port number and communicates
that ephemeral port number to the client in its response to the
client's PASV command. It listens for inbound connections to the
allocated ephemeral port number. When the client makes the connection,
the server accepts it.
In the complete absence of negotiation (no PORT command, no PASV
command), the default is for the server to allocate a socket and
open a connection from source port 20 to the port from which the
client initiated the control connection. That may be what you
were thinking of. But this default is never used in practice.
The problem is that if you use this default, you end up using the
same four-tuple of source IP, dest IP, source port, dest port for
every data connection. And connection re-use before the
MSL (maximum segment lifetime) has expired is problematic under
TCP -- you have the possibility of stale packets from the old
connection interfering with fresh packets on the new connection.
So every client in existence (barring pathologically stupid ones)
uses either the PORT or PASV command to negotiate non-default
ports for the data connections.
Post by Joseph HuberI don't think You have to do anything special
on the firewall: if the FTP (command-)port 21 is open,
then passive FTP goes through, and does not open a different -blocked- port.
This is not the case. The command connection uses port 21. The
(passive mode) data connection will use a random high port. Some
firewalls monitor traffic involving TCP port 21 looking
for dialogue that identifies the negotiated data ports and
automatically opens pinholes to permit that traffic.
John Briggs