Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm struggling to come to grasp with why all FTP servers requires the use of a port range for passive mode data channels as opposed to only using one data port for all incoming data channel connections.

FTP servers handle many simultaneously connected clients on port 21. Web servers handle many simultaneously connected clients on port 80. Etc..

Then why can't an FTP server use only one data channel port for all incoming passive data connections (and still be able to handle many simultaneously connected clients on that port, say port 1024)?

Or can it?

I am interested in knowing the technical details for why this is not possible or not recommended.

share|improve this question
    
This may be of interest to you: w3.org/Protocols/rfc959 –  Matt Simmons May 18 '11 at 12:07
    
Thanks Matt. Yes, I have read most of rfc 959, but I feel I wasn't really able to get a clear answer from that to what I was wondering about. The answer from Karol Piczak is more the kind of information I was looking for. –  Kurt May 18 '11 at 17:10
add comment

3 Answers

up vote 8 down vote accepted

a clear and technical explanation with regards to the multiple concurrent FTP sessions issue when locking the data port to only one port is what I am most interested in knowing in depth. When can it work, when will it not work, why it may not be recommended, etc.

This will be a wild guess, as I haven't tested it, you should try it for yourself and see if there are some other problems I might have missed.

I suppose you could limit the passive port range to one single port. In fact you can see in this question that small port ranges are used in practice. Theoretically, to support multiple concurrent connections you only need the 4 values: local IP, local port, remote IP, remote port to be unique. This is how you discern between different connections.

If you lock down the port on your server to one single value, then the only variable left is the port used by the client. This is not a problem, as long as the client has a large enough pool of free ephemeral ports to choose from. Unless it's doing some heavy NAT, you don't have to worry about this. Now, be warned this will be purely theoretical stuff: if you used multiple ports on your server, you could multiply the number of hypothetical concurrent connections by enabling number of ports in range connections per one port client-side. But it won't happen in practice, as I doubt there's any implementation of an FTP client that would support this (because it doesn't make much sense). Plus if the client has to share his ephemeral ports in this way and can't just open a new one, then he has much more severe problems to deal with. So, from this perspective you should be totally safe using a single port.

Let's think why a single port may not be sufficient.

First of all, I could come up with a situation where a really buggy FTP server implementation uses solely the local port number as a way to identify the client data transfer. Once again, I don't think any decent FTPd would do that.

The real problem (yes, you can disregard all above as a major digression ;-)) is that passive port range is in a non-privileged range.

This means that your selected port number is not reserved per se, and in fact any user process (doesn't need root privileges) can grab it before your FTP server does. If you have an abundant pool of ports to select from, you just grab a random free one. If you're bound to use the only one and it's already used, you won't be able to handle the transfers properly.

Sorry, if the answer seems a bit too speculative. To be honest, I tried hard to find a reason why you shouldn't use a single port and, apart from the last bit, I couldn't think of any hard evidence against it. Nevertheless, an interesting and challenging question you pose.

share|improve this answer
    
BTW, feel free to comment on missed points and inconsistencies here. Even myself, I feel as if I'm nitpicking on a simple answer - yes, you can. ;-) –  Karol Piczak May 18 '11 at 11:44
    
Thanks a lot Karol! This is spot on the kind of information I was looking for (and really hadn't found anywhere else). My main reason that I asked this question is that I want to know if it's safe to set up an FTP server in Windows Azure and lock the passive mode down to only 1 port (since Azure limits the endpoints). I have tried it, it works, and with your info I also feel safe to do it. However the only issue left is that the Azure load balancer drops the control connection after 1 minute during file transfers (because it is idle), so I'm working on a TCP tunnel with keep alive's to fix it. –  Kurt May 18 '11 at 17:01
add comment

FTP relies on two separate connections, one for the control or command stream, and one for passing the data files and other information such as directory listings. The control stream is carried over a traditional TCP connection. The client binds to a high unprivileged port and sends a connection request to the FTP server, which is bound to port 21. This connection is used to pass commands.

In Port or active mode, the client tells th server which secondary, unprivileged port it will listen on. The server then initiates the data connection from port 20 to the unprivileged port the client specified.

Passive mode, a newer mechanism, is the default when the client is a web browser. Instead of being tied to port 20, the server tells the client which high port to use for data transfer. The data is then transmitted over unprivileged ports between both client and server.

For more details, please see:

http://tools.ietf.org/html/rfc959

EDIT

As to locking the server to a particular single port, it may be possible in some servers. For example in vsftpd, you have the following configuration options.

   pasv_max_port
          The maximum port to allocate for PASV style data connections. Can be used to specify a narrow port range to assist firewalling.

          Default: 0 (use any port)

   pasv_min_port
          The minimum port to allocate for PASV style data connections. Can be used to specify a narrow port range to assist firewalling.

          Default: 0 (use any port)

If you set both ports to the same, e.g. pasv_max_port=12345, pasv_min_port=12345, you may be able to get what you are after. I suspect this will limit the number of concurrent FTP sessions you're server will support. Please test to be sure.

share|improve this answer
    
Thanks for your reply. However what I am interested in knowing is why, in passive mode, can't the ftp server tell all clients to use the same port for the data channel (say for example port 1024) as opposed to giving each client a random port from a specified port range? What are the technical reasons, if any, for why specifying only one single data port in the FTP server port range configuration is not possible or recommended? I would think an ftp server could handle many/lots of simultaneous connections even on only one data channel port, no? –  Kurt May 17 '11 at 23:40
    
Because FTP is the devil and needs to finally die. :D –  kce May 17 '11 at 23:53
1  
Thanks for your edit with regards to locking the server to a particular single port. I have actually thought about that method (and this is what I want to accomplish), but what I don't quite understand is why that would limit the number of concurrent FTP sessions the server can support. What exactly is it that would prevent the server from supporting multiple concurrent FTP sessions in this case? Because any FTP server obviously supports multiple concurrent connections on port 21, so why not also on port 12345, taken from your example? I will have to test this in greater depth. –  Kurt May 18 '11 at 0:34
    
It may not limit the number of concurrent connections. It really depends on how the server keeps track of the connections across multiple sessions. Give it a shot! –  dmourati May 18 '11 at 0:40
    
I will give a shot. Thanks for your help! –  Kurt May 18 '11 at 0:54
show 1 more comment

An FTP server might be able to match the client's Data Port connection to their Control Port connection based on the source IP alone, rather than based on the port number used.

This would break FXP (which may not be a bad thing) where the client connects to two servers (one in passive mode), then after receiving the passive server's PORT information, passes that to the active mode server as a PORT command so that active mode server connects to the passive mode server.

I suspect that many servers don't create the data socket until the client requests passive mode. In that case, if two clients requested passive mode at the same time, the sockets created would need unique port numbers.

EDIT: thought of another reason why FTP servers don't do this: the server could not tell multiple users with the same IP address apart.

share|improve this answer
    
Thanks. I guess what I don't understand is why would those data channel sockets require a unique port (on the server) if two or more clients requested passive mode at the same time? Because I'm thinking, two or more clients can obviously be connected to port 21 at the same time so why not say port 1024 (for the data channel) at the same time? I feel this may be a stupid question, but my disclaimer is that I've been awake for far too long already :) –  Kurt May 17 '11 at 23:57
    
The socket itself needs to be unique. You can create one socket listening on a port and accept as many connections as you want from that one socket, or you can create one socket per user on different ports and accept one connection from each socket. If you've designed the server to work one socket per user, then you'd essentially be rewriting everything to change it the other way around, and at the end, people on shared hosts or behind the same IP address would not be able to connect at the same time, because there'd be no way to tell their data connections apart. –  DerfK May 18 '11 at 2:27
    
Thanks. I am grateful for all the answers I have received on the subject and I think I'm starting to get a pretty good handle on it now. –  Kurt May 19 '11 at 16:11
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.