21
Summary
- // if you see it open
- Cleartext credentials and data are trivially sniffable. Anonymous FTP can expose or accept files if misconfigured (FBI PIN-170322-001, 2017, warned of actors targeting anonymous-mode FTP at medical/dental facilities for PHI/PII). The classic FTP bounce attack abuses the PORT command to open data connections to arbitrary hosts (firewall-evading port scans, Nmap -b). Brute-force/credential-stuffing routine. Plaintext FTP discouraged in favor of FTPS/SFTP.
- // common applications
- vsftpdProFTPDPure-FTPdFileZillaWinSCP
- // analyst note
- Open 21/tcp indicates an FTP server. Banner-grab for version, check whether anonymous login and AUTH TLS are supported, and treat plaintext-only internet-facing FTP as a credential-exposure finding.
About port 21/tcp.
Port 21/tcp is the control channel of the File Transfer Protocol — one of the oldest application protocols on the internet and still among the most commonly open TCP ports. FTP uses a two-channel model: commands (USER, PASS, LIST, RETR, STOR, PORT, PASV) and server replies travel on port 21, while file data moves over a separate connection. In active mode the server opens the data connection back to the client from source port 20; in passive mode (PASV) the server listens on a chosen high port that the client connects to — passive mode is what most modern FTP uses because it eases client-side NAT/firewall traversal. Transfers run in ASCII (text) or binary (image) mode. Encryption is bolted on via FTPS: explicit FTPS (FTPES) starts plaintext on 21 then issues AUTH TLS to upgrade (RFC 4217), while implicit FTPS assumes TLS immediately on the separate port 990. SFTP is unrelated despite the similar name — it is a subsystem of SSH on port 22 and shares no wire protocol with FTP. The dominant security reality is that plaintext FTP exposes credentials and data to anyone on-path; anonymous FTP can leak or accept files when misconfigured; and the classic FTP bounce attack abuses the PORT command to make the server open data connections to arbitrary hosts (usable for firewall-evading port scans). For an analyst, an open 21/tcp means an FTP server: capture the banner for version, check whether anonymous login and AUTH TLS are supported, and treat plaintext-only internet-facing FTP as a credential-exposure finding.
- IANA assignment
ftp— "File Transfer Protocol [Control]"; reference [RFC959]; assignee/contact Jon Postel; assignment note "Defined TXT keys: u=<username> p=<password> path=<path>" [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023)
- Prevalence
- nmap-services open-frequency 0.197667 — among the most common open TCP ports [Well-established] — nmap-services file
- Related ports
- 20 (FTP-data, active mode); 990 (implicit FTPS) + 989 (FTPS data); 22 (SFTP — SSH, unrelated)
Primary use
FTP control channel — commands and replies between client and server
Other/unofficial uses
explicit FTPS (AUTH TLS) shares port 21; some appliances expose admin/file features over it
Security implications
cleartext credentials/data; anonymous-FTP exposure (FBI PIN-170322-001, March 2017, warned of criminals targeting anonymous-mode FTP at medical/dental facilities for PHI/PII); FTP bounce attack via PORT (Nmap -b); brute-force/credential-stuffing; active vs passive NAT complications
Typically seen on
FTP servers, NAS appliances, legacy file-exchange hosts, some network devices
- Analyst note
- Open 21/tcp indicates an FTP server. Banner-grab for version, check whether anonymous login and AUTH TLS are supported, and treat plaintext-only internet-facing FTP as a credential-exposure finding.
About port 21/udp.
Port 21/udp is a registry artifact rather than a deployed service. IANA dual-registers port 21 under the service name ftp for both TCP and UDP, with identical fields on each row — description "File Transfer Protocol [Control]", assignee and contact Jon Postel, reference [RFC959], and the assignment note defining TXT keys u=<username> p=<password> path=<path>. The catch is that the protocol the registry points to, RFC 959, defines FTP exclusively over TCP: FTP depends on a connection-oriented, reliable, in-order byte stream with the explicit error handling and flow control that TCP provides, and there is no FTP-over-UDP transport in the standard. The UDP entry exists because of the historical IANA practice of assigning a well-known port on both transports even when only one is used in practice — the same pattern seen on many low-numbered ports. No mainstream software listens on 21/udp: the FTP control channel that servers such as vsftpd, ProFTPD, FileZilla Server, and Microsoft IIS FTP expose, and that clients such as FileZilla and WinSCP connect to, is the TCP one on 21/tcp. Internet scanners (Shodan, Censys) and exploitation tooling target FTP over TCP; UDP probes to port 21 are not a standard FTP technique because the service does not answer on UDP. The well-documented FTP security problems — cleartext credential and data exposure, anonymous-access misconfiguration, the FTP bounce attack via the PORT command, directory traversal, and credential brute-forcing — are all TCP-side concerns and do not transfer to the UDP registration. For an analyst, UDP/443-style real-world usage does not exist here: traffic to 21/udp on a host is most likely mis-categorized TCP activity or background noise rather than a live FTP-over-UDP service, and the substantive FTP risks live entirely on 21/tcp.
- IANA assignment
ftp— "File Transfer Protocol [Control]"; reference [RFC959]; assignee/contact Jon Postel; assignment note "Defined TXT keys: u=<username> p=<password> path=<path>"; dual-registered 21/tcp + 21/udp (identical rows)[Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (cached CSV, rows 47–48)- Range class
- well-known (0–1023) [Confirmed] — IANA registry
- IANA registration/modification date
- blank in the registry (no date published; not fabricated) [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry
- Prevalence
- not meaningfully observed; 21/udp is not a standard scanning target because FTP does not respond over UDP. The high real-world prevalence of "port 21" applies to 21/tcp, not the UDP twin [Likely] — RFC 959, IANA registry
- Related ports
- 21/tcp (FTP control — the channel that is actually used); 20 (FTP-data, active mode); 990 (implicit FTPS); 22 (SFTP — SSH, unrelated)
Primary use
none in practice on UDP — the registration mirrors the TCP ftp assignment; RFC 959 specifies FTP over TCP only, so there is no standard FTP-over-UDP transport
Other/unofficial uses
none notable; no known software implements FTP over UDP on port 21
Security implications
no independent attack surface on UDP. No real-world service listens on 21/udp and scanners do not meaningfully probe it; residual UDP/21 traffic is most likely mis-categorized TCP or noise. The substantive FTP risks — cleartext credential/data exposure, anonymous-access misconfiguration, FTP bounce via PORT, directory traversal, brute-force — are all 21/tcp concerns
Typically seen on
nothing as a live UDP service; the FTP control channel runs on 21/tcp (vsftpd, ProFTPD, FileZilla Server, IIS FTP)
- Analyst note
- Treat 21/udp as a registry mirror, not a service. An apparent open/responsive 21/udp warrants confirming the host is not simply showing mis-categorized TCP FTP; real FTP analysis (banner, anonymous login, AUTH TLS) belongs on 21/tcp.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| ftp | TCP | File Transfer [Control] | 19.77% |
| ftp | UDP | File Transfer [Control] | 0.48% |
| ftp | SCTP | File Transfer [Control] | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.