20
Summary
- // if you see it open
- Same cleartext data/metadata exposure as the FTP control channel. Active mode's inbound-to-client data connections cause well-known NAT/firewall complications, which is why passive mode predominates today.
- // common applications
- vsftpdProFTPDPure-FTPdFileZilla
- // analyst note
- 20/tcp open in isolation is unusual; interpret it as the active-mode data sibling of port 21. Its low prevalence reflects the dominance of passive mode.
About port 20/tcp.
Port 20/tcp is the default server-side source port for the FTP data connection in active mode. FTP separates control from data: while commands and replies use port 21, the actual file bytes move over a second connection, and in active mode the server originates that connection from port 20 to a client-specified port named in the PORT command. In passive mode (PASV) this port is not used at all — the data connection instead goes to a server-chosen high port that the client dials out to, which is why passive mode dominates today and why port 20 is rarely seen open on its own. The IANA registry lists ftp-data with a blank Reference field: the registry itself does not bind this port to an RFC, although the data-channel behavior is described in RFC 959 (which is the governing protocol spec, not the IANA-cited reference). Security-wise, the data channel carries the same cleartext exposure as the control channel — file contents (and, for directory listings, metadata) travel unencrypted unless FTPS/TLS is in use — and active mode's inbound-to-client data connections are the source of FTP's well-known NAT and firewall complications. For an analyst, seeing 20/tcp open in isolation is unusual and is meaningful chiefly as the active-mode data sibling of port 21; its very low nmap-services open-frequency (0.001079) reflects that passive mode is now standard.
- IANA assignment
ftp-data— "File Transfer [Default Data]"; reference (blank — no RFC cited in IANA registry); assignee/contact Jon Postel; governing protocol RFC 959 (not the IANA-cited reference) [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023)
- Prevalence
- nmap-services open-frequency 0.001079 (rarely open standalone; passive mode is standard) [Well-established] — nmap-services file
- Related ports
- 21 (FTP control); 989 (FTPS data); 990 (implicit FTPS control)
Primary use
active-mode FTP data connection (server source port 20 → client)
Other/unofficial uses
none notable beyond FTP itself [n/a]
Security implications
same cleartext data/metadata exposure as the control channel; active-mode inbound data connections cause NAT/firewall complications
Typically seen on
FTP servers configured for active-mode transfers
- Analyst note
- 20/tcp open in isolation is unusual; interpret it as the active-mode data sibling of port 21. Its low prevalence reflects the dominance of passive mode.
About port 20/udp.
Port 20/udp is a historical parallel registration: IANA lists it under the same ftp-data service name and "File Transfer [Default Data]" description as 20/tcp, with a blank Reference field and assignee/contact Jon Postel. The important caveat is that nothing actually runs on it. FTP is defined in RFC 959 exclusively over TCP — the control channel uses port 21 and the active-mode data channel originates from port 20/tcp — and no known FTP implementation has ever used UDP for data transfer. In the early port registry it was common for a number to be reserved on both TCP and UDP at once, so 20/udp exists as the UDP twin of the real TCP data port rather than as a service in its own right; the IANA registry binds it to no RFC. (A separate SCTP registration for port 20 does exist, references RFC 9260, and was added 2022-02-07, but that is a distinct transport and does not apply to UDP.) For an analyst, an open or responsive 20/udp is therefore not a normal service signature — there is no legitimate daemon to answer it. Any genuine FTP exposure, and the associated cleartext data/metadata risk, lives on 20/tcp (active-mode data) and 21/tcp (control); generic "port 20 seen in malware traffic" notices that circulate do not distinguish the UDP variant from TCP and cite no specific tool, so they carry little weight on their own.
- IANA assignment
ftp-data— "File Transfer [Default Data]"; reference (blank — no RFC cited in IANA registry); assignee/contact Jon Postel; dual-registered with 20/tcp (same service name/description); a distinct 20/sctp registration references RFC 9260[Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (CSV row 45)- Range class
- well-known (0–1023) [Confirmed]
- Prevalence
- effectively zero legitimate traffic — no service listens on 20/udp [Likely] — RFC 959 (TCP-only), IANA registry
- Related ports
- 20/tcp (active-mode FTP data — the port that carries real usage); 21 (FTP control); 989 (FTPS data); 990 (implicit FTPS control)
Primary use
none in practice — the UDP entry is a legacy parallel registration; FTP (RFC 959) runs over TCP only, and no FTP implementation uses UDP for data
Other/unofficial uses
none notable; all real ftp-data usage is on 20/tcp [Confirmed]
Security implications
no active protocol to expose on 20/udp itself; the cleartext file/metadata exposure and active-mode NAT/firewall complications of FTP belong to 20/tcp and 21/tcp. A generic historical note flags the port number in trojan/virus traffic, but it does not distinguish UDP from TCP and cites no specific malware
Typically seen on
nothing in normal operation; a responsive 20/udp is an anomaly worth investigating rather than an expected service
- Analyst note
- Treat 20/udp as a registration artifact, not a service. There is no FTP-over-UDP; route any real FTP investigation to 20/tcp and 21/tcp.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| ftp-data | UDP | File Transfer [Default Data] | 0.19% |
| ftp-data | TCP | File Transfer [Default Data] | 0.11% |
| ftp-data | SCTP | File Transfer [Default Data] | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.