The hosting service for one site I manage seems to accept connections using FTP and SFTP using the same connection information. Because this site was hacked, likely through sniffing FTP, I want to be especially careful that setting client apps to use SFTP actually results in secure connections, and especially so because the hosting service --a very well-known company-- does a very poor job at documenting the availability and use of SFTP for customers.
Is there a simple, client-app-independent way of verifying that there is or isn't an active SFTP connection with a particular server on Windows (XP or newer)? On MacOS 10.5+, GUI or unix shell?
"Simple": cheap (preferably a standard OS tool), easy to use, obvious results, preferably by lo-tech users.
Blocking FTP access entirely may not be feasible for some users, but it certainly has promise as a simple, fairly definitive method of transiently proving that a particular connection isn't FTP, if FTP and SFTP are the only alternatives. Establish and verify that the connection works, then block FTP. These days, it's generally very simple to do so at the OS firewall. If the connection stops working, then the connection is obviously SFTP. (Or vice-versa.) That's a great answer to my basic query.
I'm aware that SFTP is a completely different protocol. Awkwardly, an important client application --web-authoring s/w from a major vendor-- strongly implies the similarity by listing SFTP as a minor option beneath FTP. It is probably only a UI mis-design, but that's the source of my worry that SFTP connection failure might cause the app to fall back on FTP. Plus, my worry is increased by the fact that the hosting services uses exactly the same setup for SFTP, specifically "ftp.example.com". (Is that common? I expect a distinct host for SFTP, e.g., "sftp.example.com") As I said, having been hacked, I'm paranoid.