989

Port 989/tcp is the data-transfer channel paired with the implicit-FTPS control channel on port 990. In implicit FTPS, where TLS is negotiated immediately on connect, the file contents and directory listings move over this separate TLS-wrapped connection — the encrypted analogue of plaintext ftp-data on port 20. It is rarely seen open on its own because, like all FTP data channels, it is used only transiently during an active transfer and its use is coordinated by the control session on 990; seeing 989 without 990 is unusual. The IANA registry lists ftps-data with a blank reference field (and a blank assignee), so RFC 4217 — which standardizes FTP-over-TLS generally — is the governing protocol document but not the IANA-cited reference. Security-wise it carries the same considerations as the rest of implicit FTPS: the data is encrypted in transit, but the two-channel FTP model creates NAT and firewall traversal complexity (passive-mode port ranges must be opened, and TLS session resumption between the control and data channels must be handled correctly), which is a large part of why single-channel SFTP (SSH, port 22) is often preferred. For an analyst, 989/tcp is meaningful chiefly as the data sibling of 990; evaluate it in that context rather than in isolation.

IANA assignment

ftps-data — "ftp protocol, data, over TLS/SSL"; reference (blank — no RFC cited in IANA registry); assignee/contact blank; governing protocol RFC 4217 (not the IANA-cited reference) [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

rare as a standalone open port (used transiently during transfers; de-facto, nmap-services) [Well-established] — nmap-services file

Related ports

990 (FTPS control); 20 (plaintext FTP-data); 21 (FTP control); 22 (SFTP — SSH, unrelated)

Primary use

implicit-FTPS data channel — encrypted file/listing transfer paired with control on 990

Other/unofficial uses

none notable beyond implicit FTPS [n/a]

Security implications

same NAT/firewall data-channel complexity as implicit FTPS; data encrypted in transit but the two-channel model complicates filtering; SFTP often preferred

Typically seen on

managed-file-transfer (MFT) appliances and legacy FTPS servers configured for implicit TLS

Analyst note

989/tcp is meaningful chiefly as the data sibling of 990; evaluate it together with the control channel rather than in isolation.

Port 989/udp is registered with IANA as ftps-data with the description "ftp protocol, data, over TLS/SSL." It is the UDP half of a dual registration: both 989/tcp and 989/udp carry the same service name and description, and the companion control channel is ftps on port 990. In the IANA Service Name and Transport Protocol Port Number Registry the Assignee, Contact, Registration Date, Modification Date, and Reference columns are all blank for this entry — no RFC is cited for port 989 on either transport. The service name refers to the data channel used by FTPS (FTP over TLS/SSL) in implicit mode, where TLS is negotiated immediately on connection: port 989 is meant to carry the encrypted file-data stream while port 990 carries the control channel. The practical reality is that FTPS, like plain FTP, depends on reliable, ordered, connection-oriented delivery, so every real-world deployment uses the TCP variant. The UDP assignment exists in the registry for symmetry but is not used by any known implementation. The mainstream FTPS server and client ecosystem — FileZilla Server, Cerberus FTP, ProFTPD, vsftpd, WS_FTP — implements only the TCP form, and implicit FTPS over TCP 989/990 shows up in finance, healthcare, government, and legacy enterprise batch-transfer workflows. For an analyst the security-relevant surface (weak TLS ciphers, deprecated protocol versions, expired or self-signed certificates enabling MitM, brute-force on exposed servers) lives entirely on the TCP counterpart; 989/udp carries no documented traffic. SANS Internet Storm Center has a port 989 page but shows no populated UDP scan activity, and no CVEs, malware, or scanning campaigns targeting 989/udp specifically were found across the sources reviewed. A responsive 989/udp is therefore an anomaly worth investigating rather than a normal service.

IANA assignment

ftps-data — "ftp protocol, data, over TLS/SSL"; reference (blank — no RFC cited in IANA registry); Assignee/Contact/Registration Date/Modification Date all blank; dual-registered 989/tcp + 989/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry lines 1635–1636)

Range class

well-known (0–1023)

Related ports

990 (ftps control channel), 21 (plain FTP control), 20 (plain FTP data); contrast SFTP on 22

Primary use

data channel for implicit FTPS (FTP over TLS/SSL); paired with the ftps control channel on port 990. Assigned for UDP but used only over TCP in practice

Other/unofficial uses

none known on UDP; no software is documented sending traffic on 989/udp

Common software

FTPS ecosystem (FileZilla Server, Cerberus FTP, ProFTPD, vsftpd, WS_FTP) implements the TCP variant only; no implementation uses 989/udp

Security implications

meaningful attack surface (weak TLS configs, deprecated protocol versions, expired/self-signed certs enabling MitM, brute force) sits on 989/tcp, not UDP; no CVEs or malware target 989/udp specifically; auditmypc lists no Trojan/virus associations for UDP 989

Exposure/scanning

SANS Internet Storm Center port 989 page shows no populated UDP scan-activity data (June 2026); not a documented mass-scanning target on UDP

Typically seen on

nothing on UDP; the TCP counterpart appears on FTPS servers in finance/healthcare/government/legacy enterprise file-transfer workflows

Analyst note

989/udp is an IANA-registered but functionally dead assignment. A responsive 989/udp is an anomaly — investigate as a decoy, backdoor, or misconfiguration rather than legitimate FTPS, which uses TCP.