990
Summary
- // if you see it open
- Encryption protects credentials/data in transit, but it is still FTP underneath: the separate data channel creates NAT/firewall traversal complexity; TLS misconfiguration (weak ciphers, expired/self-signed certs) is common; implicit vs explicit FTPS is frequently confused. SFTP (SSH, port 22) is often preferred for its single-channel design.
- // common applications
- vsftpdProFTPDFileZilla
- // analyst note
- Open 990/tcp indicates an implicit-FTPS server. Confirm the certificate and TLS version, and check that the 989 data channel and passive-mode ports are correctly firewalled.
About port 990/tcp.
Port 990/tcp is the control channel for implicit FTPS — FTP wrapped in TLS that is negotiated immediately on connect, before any FTP command is exchanged. This is the older of the two ways to secure FTP and contrasts with explicit FTPS (FTPES), standardized in RFC 4217 (2005), which runs on the normal control port 21 and upgrades opportunistically via the AUTH TLS command. In the implicit model the client connects to 990, the TLS handshake happens first, and the encrypted FTP control session then proceeds with its data channel riding on port 989 — mirroring the 21/20 plaintext control/data split. Implicit FTPS was treated as deprecated for a period in favor of explicit FTPS, but ports 990/989 remain IANA-registered (assignee Christopher Allen) and in active use, particularly in managed-file-transfer appliances and compliance-driven environments. The IANA registry cites no RFC for the ftps/990 assignment — the reference field is blank — so RFC 4217 (which standardizes FTP-over-TLS generally) is the governing protocol document but not the IANA-cited reference. Security-wise, the encryption protects credentials and data in transit, but it is still FTP underneath: the separate data channel creates NAT/firewall traversal complexity (passive-mode port ranges, TLS session resumption), TLS misconfiguration (weak ciphers, expired/self-signed certs) is common, and SFTP (SSH file transfer, port 22) is frequently preferred for its single-channel, firewall-friendly design. For an analyst, an open 990/tcp indicates an implicit-FTPS server; confirm the certificate and negotiated TLS version, and check whether the data channel (989) and passive ports are correctly firewalled.
- IANA assignment
ftps— "ftp protocol, control, over TLS/SSL"; reference (blank — no RFC cited in IANA registry); assignee/contact Christopher Allen; governing protocol RFC 4217 (not the IANA-cited reference) [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023)
- Prevalence
- moderately common on dedicated file-transfer servers (de-facto; nmap-services) [Well-established] — nmap-services file
- Related ports
- 989 (FTPS data); 21 (plaintext FTP control + explicit FTPS via AUTH TLS); 20 (plaintext FTP-data); 22 (SFTP — SSH, unrelated)
Primary use
implicit-FTPS control channel — TLS on connect, then encrypted FTP control
Other/unofficial uses
none notable beyond implicit FTPS [n/a]
Security implications
still FTP underneath (NAT/firewall data-channel complexity); TLS misconfiguration (weak ciphers, bad certs); implicit-vs-explicit confusion; SFTP often preferred
Typically seen on
managed-file-transfer (MFT) appliances, legacy enterprise FTPS servers
- Analyst note
- Open 990/tcp indicates an implicit-FTPS server. Confirm the certificate and TLS version, and check that the 989 data channel and passive-mode ports are correctly firewalled.
About port 990/udp.
Port 990/udp is registered with IANA as ftps, described as "ftp protocol, control, over TLS/SSL," assigned to Christopher Allen, with a blank reference field — no RFC is cited in the registry row. It is dual-registered alongside 990/tcp, which carries the identical service name and description. In practice the UDP registration is a paper mirror only: real FTPS traffic runs exclusively over TCP, because FTP's command/response sequencing depends on reliable, ordered delivery that UDP does not provide, and no FTPS implementation is known to listen on 990/udp. The meaningful counterpart is 990/tcp, the well-known control-channel port for *implicit* FTPS — the client connects and a TLS handshake fires immediately on connection, rather than being negotiated later via an explicit STARTTLS-style AUTH TLS command on port 21. Data transfers for implicit FTPS use the paired port 989 (ftps-data). The implicit-mode convention on 990 predates RFC 4217 (October 2005), which standardised *explicit* FTPS on port 21; implicit mode on 990 is a legacy convention still supported by most FTP server software (FileZilla Server, vsftpd, ProFTPD, Cerberus FTP, IBM z/OS FTP, Axway SecureTransport) but is no longer the recommended approach. For an analyst, 990/udp itself is essentially never a live service target: scanners (Shodan, Masscan) index 990/tcp for implicit-FTPS banners, while 990/udp sees negligible activity. Where 990/tcp is exposed, the relevant risks are weak TLS cipher/version configuration, certificate-validation bypass when clients skip checks, and credential brute-forcing — vulnerabilities living in the FTPS server and its TLS setup, not in the port number.
- IANA assignment
ftps— "ftp protocol, control, over TLS/SSL"; reference (blank — no RFC cited in IANA registry); assignee/contact Christopher Allen; dual-registered 990/tcp + 990/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry, line 1638; tcp counterpart line 1637)- Range class
- well-known (0–1023) [Confirmed] — port number 990 < 1024
- Registration / modification date
- Unknown (both columns blank in the IANA registry) [Confirmed] — IANA registry
- IANA reference
- blank (RFC 4217 covers explicit FTPS on port 21, not the 990 implicit registration) [Confirmed] — IANA registry; RFC 4217
- Related ports
- 989/tcp+udp (ftps-data); 21/tcp (FTP control / explicit FTPS via AUTH TLS); 20/tcp (FTP active data)
Primary use (UDP)
mirror registration only — no documented real-world UDP use; FTPS requires reliable ordered TCP delivery
Primary use (TCP counterpart)
implicit FTPS control channel — TLS handshake on connect, then standard FTP command/response over the encrypted channel; data on port 989
Common software (TCP side; no UDP implementations known)
FileZilla Server/Client, vsftpd (implicit-ssl), ProFTPD (mod_tls), Cerberus FTP Server, IBM z/OS FTP, Axway SecureTransport, WinSCP (client)
Security implications
990/udp negligible scan target; exposed 990/tcp implicit-FTPS subject to weak TLS cipher/version misconfig, cert-validation bypass, credential brute-force, MITM when cert checks skipped; no CVEs specific to the port number — risk lives in server impl + TLS config; restrict by IP where possible
- Analyst note
- A response on 990/udp is anomalous — real FTPS is TCP-only; treat 990/tcp as the meaningful surface and assess its TLS posture.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| ftps | TCP | ftp protocol, control, over TLS/SSL | 0.56% |
| ftps | UDP | ftp protocol, control, over TLS/SSL | 0.46% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.