When using Passive FTP, is it possible that the port number specified by the server could be altered in any way?

For instance, if I see in the logs on my server the following, is it possible that the server actually supplied a value other than that recorded? (Note, the IP has been removed to keep anonymous)

227 Entering Passive Mode (xxx,xxx,xxx,xxx,19,181)

Unless I'm reading this incorrectly, the server in question has stated that port 5045 is to be used ((19*256)+181)

I'm currently in an argument with a Cloud Storage hosting company - who I won't name, because that is not fair on them.

They say their passive FTP port range is the Microsoft "standard" of 1025-5000... but the logs on my server (dealing with regular backups, and quotes above in the example) show that the port regularly exceeds the 5000 limit.

They adamantly deny that their server is set up for anything outside of that standard range.

What I need to know is whether my log files are actual evidence that ports are being specified outside of their stated range - or whether the server hosting company (where the cloud servers I'm running are sending information via FTP) could have any effect on it?


The company that is hosting the cloud-server that our applications run on have confirmed that there is nothing at their end that would be changing the port.

I still believe the range of ports that the FTP server is configured for exceeds the 5000 limit they state... but I have no way of proving it.

The system is currently operational, and working as I need it to - thanks to the host company opening a larger range of outbound ports.

I would still be interested to know what options (if there are others to the ones listed by @Steffan) could possibly effect the port number. But this is more for interest than to fix an urgent problem.


Is it possible that the server actually supplied a value other than that recorded?

Usually the IP and port provided in the response to PASV are local to the server. But since FTP is protocol which causes lots of trouble when used with NAT routes, firewalls etc sometimes the IP you see in the response is not the IP of the server:

  • Some servers have the ability to specify a different IP in the configuration file, which should be used inside the response instead of the server real IP. This is used to work around problems when the server is used behind a NAT router with port forwarding.
  • In a similar situation (server behind NAT router) it can happen that you actually connect to the NAT router (i.e. FTP control connection) but the IP in the passive response looks different. In this case this is usually the real local IP of the server and the public visible IP of the router.
  • Then there are router or firewalls which employ helpers to deal with FTP. These helpers might rewrite the IP and maybe also port in the PASV response to point to a listener or packet filter state on the middlebox itself. This might be what's happening in your case.
  • Thanks Steffen - does it make any difference that the IP is exactly as it should be in the logs? In other words, the IP in the logs is the actual IP address of the FTP site for the cloud storage company – freefaller Mar 20 '15 at 13:26
  • One actually could make a proxy behave like this but it would be unusual. I would suggest you do packet captures at client and server side to see what's really going on. But of course it could be that the IP you connect to is not the IP of the original server but of a firewall/router in front of it. – Steffen Ullrich Mar 20 '15 at 13:27
  • Capturing anything server-side is out of the question - the server is the FTP server of a cloud storage company. Maybe I need to ask the company hosting our cloud servers (that are creating the FTP connection to the storage site) if it is possible that the port is being altered at their end – freefaller Mar 20 '15 at 13:29
  • But of course it could be that the IP you connect to is not the IP of the original server but of a firewall/router in front of it.... that is a fair comment, but if that was the case, wouldn't the storage company tell me that, rather than continuously state their range is 1025-5000? – freefaller Mar 20 '15 at 13:30
  • I would suggest this. You might make a packet dump to prove it but I would suggest you are making sure that no device on your side is actually changing the traffic. – Steffen Ullrich Mar 20 '15 at 13:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.