One Byte at a Time: Is Your FTP Active or Passive?
by Thomas M. Thomas, NetCerts
What many people don't know is that the File Transfer Protocol (FTP) has multiple modes of operation that can dramatically affect its operation and, as a result, the security of your network. These modes of operation determine whether the FTP server or FTP client initiates the TCP connections that are used to send information from the server to the client. The FTP protocol supports two modes of operation, as follows:
The active mode of operation is less secure than the passive mode. This mode of operation complicates the construction of firewalls,
because the firewall must anticipate the connection from the FTP server back to the client program. The steps of this mode of operation are discussed below and are shown in Figure 1.
Passive FTP Operation
This mode of operation is assumed to be more secure because all the connections are being initiated from the client, so there is less chance that the connection will be compromised. The reason it is called passive is that the server performs a "passive open." The steps of this mode of operation are discussed below and are shown in Figure 2.
References
He worked as part of a team on a new course on Multilayer Switching. He also wrote the book OSPF Network Design Solutions for Cisco Press. Tom has also worked as a senior network engineer and group leader of the Advanced Systems Solutions Engineering Team for MCI's Managed Network Services.
In this capacity, he developed network maintenance Standard Operating Procedures and performed various in house training duties. Before joining MCI, Tom worked as a technical team leader at AT&T Solutions, where he provided technical support and network management for Cisco routers over ATM and Frame Relay and configured various networking protocols. E-mail: tothomas@netcerts.com
by Thomas M. Thomas, NetCerts
What many people don't know is that the File Transfer Protocol (FTP) has multiple modes of operation that can dramatically affect its operation and, as a result, the security of your network. These modes of operation determine whether the FTP server or FTP client initiates the TCP connections that are used to send information from the server to the client. The FTP protocol supports two modes of operation, as follows:
- The first FTP mode of operation is known as normal, though it is often referred to as active. This mode of operation is typically the default.
- The second FTP mode of operation is known as passive. In active (normal) FTP, the client opens a control connection on port 21 to the server, and whenever the client requests data from the server, the server opens a TCP session on port 20. In passive FTP, the client opens the data sessions, using a port number supplied by the server.
The active mode of operation is less secure than the passive mode. This mode of operation complicates the construction of firewalls,
because the firewall must anticipate the connection from the FTP server back to the client program. The steps of this mode of operation are discussed below and are shown in Figure 1.
- The client opens a control channel (port 21) to the server and tells the server the port number to respond on. This port number is a randomly determined port greater than 1023.
- The server receives this information and sends the client an acknowledgement "OK" (ack). The client and server exchange commands on this control connection.
- When the user requests a directory listing or initiates the sending or receiving of a file, the client software sends a "PORT" command that includes a port number > 1023 that the client wishes the server to use for the data connection.
- The server then opens a data connection from port 20 to the client's port number, as provided to it in the "PORT" command.
Figure 1: Active-Mode FTP Connection
Passive FTP Operation
This mode of operation is assumed to be more secure because all the connections are being initiated from the client, so there is less chance that the connection will be compromised. The reason it is called passive is that the server performs a "passive open." The steps of this mode of operation are discussed below and are shown in Figure 2.
- In passive FTP, the client opens a control connection on port 21 to the server, and then requests passive mode through the use of the "PASV" command.
- The server agrees to this mode, and then selects a random port number (>1023). It supplies this port number to the client for data transfer.
- The client receives this information and opens a data channel to the server assigned port.
Figure 2: Passive-Mode FTP Connection
References
- Internetworking With TCP/IP, Volume 1: Principles, Protocols, Architecture, Third Edition, by Douglas E. Comer, ISBN 0-13-216987- 8, Prentice Hall, 1995.
- R. Braden, "Requirements for Internet hosts application and support," RFC 1123, October 1989.
- S. Bellovin, "Firewall-Friendly FTP," RFC 1579, February 1994.
- P. Deutsch, A. Emtage, A. Marine, "How to Use Anonymous FTP," RFC 1635, May 1994.
He worked as part of a team on a new course on Multilayer Switching. He also wrote the book OSPF Network Design Solutions for Cisco Press. Tom has also worked as a senior network engineer and group leader of the Advanced Systems Solutions Engineering Team for MCI's Managed Network Services.
In this capacity, he developed network maintenance Standard Operating Procedures and performed various in house training duties. Before joining MCI, Tom worked as a technical team leader at AT&T Solutions, where he provided technical support and network management for Cisco routers over ATM and Frame Relay and configured various networking protocols. E-mail: tothomas@netcerts.com
8 comments:
Subscribe to:
Post Comments (Atom)
How can i wipe windows xp from my laptop and reinstall windows Me -the laptops first software?
I suffer with recently bought a acquainted with laptop that is old. The living soul I had bought it from had installed windows xp on it, even though it originally came with windows Me. I fall short of to expunge the windows xp because it runs slows on the laptop because it takes up more memory than the windows Me would. Also I wish to massacre windows xp because it is an forbidden copy. So when I tried to stir one's stumps updates on it, windows would not set up updates because the windows xp is not genuine. [URL=http://iwpukge.tripod.com]adjustable fuel pressure regulator tbi[/URL]
----------------------------------------------------------------------
Answers :
It's more advisedly to take one's leave of [URL=http://nuszbaw.tripod.com/vf-imagewear.html]vf imagewear[/URL] Windows XP and even-handed upgrade your laptop. It's much better. [URL=http://coabusp.tripod.com/ensanada-weather-march.html]ensanada weather march[/URL] In addition to, Windows XP is style [URL=http://pncoayo.tripod.com/buttermouth-top-25.html]buttermouth top 25[/URL] healthier then Windows Me. Windows Me is unused and tons programs that can run with XP, can't [URL=http://boixpau.tripod.com/chocolate-blue-backpack.html]chocolate blue backpack[/URL] run with Me.
------------------------------
all you have to do is insert the windows me disk into the cd drive. then reboot your laptop, when the black [URL=http://wuimrxf.tripod.com/leather-chaps-cowboy-action-shooting.html]leather chaps cowboy action shooting[/URL] sift with all the info comes up and when it asks u to boot from cd [URL=http://fgelyem.tripod.com/bump-key-proof-locks.html]bump key proof locks[/URL] chance any key when it tells you to then install from there !!! I RECOMEND SINCE ITS AN ILLEAGLE TWIN TO WIPE [URL=http://coabusp.tripod.com/energy-star-checklist-for-hotels-motels.html]energy star checklist for hotels motels[/URL] OUT OF THE CLOSET THE [URL=http://ftpzsee.tripod.com/smith-wesson-mp-pistols.html]smith wesson mp pistols[/URL] ENTIRE HARD SEND WHEN IT ASKS YOU WHICH IMPENETRABLE [URL=http://mnepair.tripod.com/russ-codd.html]russ codd[/URL] PROD TO INSTITUTE IT ON. THEN UNITE ALL THE ABOVE PAUSE ON THE CLEAR [URL=http://snuhexi.tripod.com/space-heater-shed.html]space heater shed[/URL] HARD CONSTRAIN ONTO A DIFFERENT ORDER SITE, IT ON LOOK LIKE C:/ Sore or something like that
Tender-hearted prostatic hyperplasia, commonly known as BPH, is an enlargement of the prostate area. It is more profuse in older men. As men are fetching more educated connected with healthfulness issues, they turn to medical treatment instead of BPH. Dutas, a generic appearance of Avodart([URL=http://jeqpqpv.1freewebspace.com/avodart-and-arthritis.html]avodart and arthritis[/URL] [URL=http://jeqpqpv.1freewebspace.com/side-effects-avodart-discolored-semen.html]side effects avodart discolored semen[/URL] [URL=http://jeqpqpv.1freewebspace.com/avodart-full-prescribing-information.html]avodart full prescribing information[/URL] [URL=http://jeqpqpv.1freewebspace.com/avodart-and-arthritic-symptoms.html]avodart and arthritic symptoms[/URL] [URL=http://jeqpqpv.1freewebspace.com/price-of-avodart.html]price of avodart[/URL] ), has been proven as an effective treatment of BPH. BPH and its symptoms that adversely change the grade of lifestyle can be treated successfully by Dutas. The essential foretoken evidence of BPH is the frequency of essential to urinate. This occurs almost always at night but then progresses to the necessary to urine frequently in every part of the day. BPH sufferers subsequently circulate a reduction in tenaciousness in urine stream. Discomfort accompanies this reduction. A medical doctor should direct testing to terminate if BPH is the source of the symptoms. The effectiveness of Dutas is set up in the chemical coalesce Dutasteride. This running ingredient is an alpha-reductase 5 inhibitor which impedes the conversion of testosterone into dihydrotestosterone (DHT). DHT is considered a telling form of testosterone. BPH symptoms vanish promptly the conversion is interrupted. Dutas has been organize to be effective in BPH seeking uncountable sufferers. Prescriptions finasteride and finasteride has been shown to at best govern a person isoform of alpha redictase 5. It has been established that Dutasteride has been proven to impede two isoforms. Dutas incontestably appears to furnish the best treatment close by seeking BPH. Dutas impel be infatuated as directed with some precautions. Erectile dysfunction and decreased sexual libido are the most commonly reported side effects during practice of Dutas. Gynecomastia or enlargement of man's titty network is another accomplishable side effect. Additionally, women who are teeming or women wanting to be proper expectant should not be exposed to Dutas; developing virile fetuses can be adversely affected by these inhibitors. Dutas can be immersed via the peel so individual care should be exercised notwithstanding charged women or women wanting to fit pregnant. Another side effect of Dutas is a favourable one. Some men oblige reported curls replenishment while enchanting Dutas. BPH can be treated away discussing medications and plausible side effects with a medical professional. Dutas can give competent treatment of BPH. A worry-free, active way of life is well advantage the effort.
[URL=http://jeqpqpv.1freewebspace.com/avodart-receding-hairline.html]avodart receding hairline[/URL]
[URL=http://jeqpqpv.1freewebspace.com/avodart-frontal-baldness.html]avodart frontal baldness[/URL]
[URL=http://jeqpqpv.1freewebspace.com/avodart-prostate-bph.html]avodart prostate bph[/URL]
[URL=http://jeqpqpv.1freewebspace.com/avodart-patient-info.html]avodart patient info[/URL]
[URL=http://jeqpqpv.1freewebspace.com/does-avodart-work.html]does avodart work[/URL]
In it something is. Now all is clear, thanks for an explanation.
I consider, that you are not right. I suggest it to discuss. Write to me in PM, we will communicate.
Yоur сurгеnt wгite-up fеatures confіrmеԁ useful to myself.
It’s really helpful and уou're simply clearly very educated in this area. You have got popped my personal sight to various opinion of this particular matter with intriquing, notable and sound written content.
Also visit my page; buy Valium Online
Here is my page ; buy Valium
hey theгe and thank you for уour informatіon –
I have definіtely pіckеd up ѕomething new from гight hеre.
I diԁ however еxpеrtise sеveral technical iѕsuеs using this site, as I experiеnced to rеload the wеb site many times рreνious to I coulԁ gеt it tо load correctlу.
Ӏ had been wоnderіng if your hosting is OK?
Not that Ι am cоmplaining, but slow lοading instanceѕ times will often affect your plаcement in google and coulԁ damage your high quality score if ads and marketing with Αdwordѕ.
Anyway I аm adding this RSS to my e-mаil and could look
out for much moгe οf your respective fascinating сontent.
Ensure that you update thiѕ again very soon.
Feel free to surf to my website; payday loans
I vіsited multiplе blogs but the audio featuгe fοr аudio songs cuггent
at this sіtе is truly fabulous.
My site: payday loans
Hey there would you mind letting me know which webhost you're working with?
I've loaded your blog in 3 different internet browsers and I must say this blog loads a
lot quicker then most. Can you suggest a good hosting provider at a reasonable price?
Thanks, I appreciate it!
My website ... website marketing company