Question Regarding Server-Side Data Port Behavior in FTP Active Mode

Question

Hello,

I am evaluating the functionality of Rebex File Server.

I implemented an FTP server using the Rebex File Server Library. I observed the following behavior, but I could not find documentation explaining it, so I would like to ask about it.

Action 1

FTP Server - bind port 21, Windows, Net6
FTP Client - Connected using active mode
Result - data port of server-side is 20

Action 2

OS - windows
FTP Server - bind port 9021, Windows, Net6
FTP Client - Connected using active mode
Result - data port of server-side is random number.

Detail

• When the FTP server uses a Well-Known port between 1 and 1023, the server-side data port in active mode appears to be the server control port minus 1.
• When the FTP server uses a port of 1024 or higher, the server-side data port in active mode appears to be assigned dynamically/randomly.

Question

Is this behavior intentional by design? Specifically, does Rebex File Server use a different method for selecting the server-side data port in active mode depending on whether the FTP server control port is a Well-Known port or a non-Well-Known port?

Best regards.

Answer 1

Yes, this is desired behavior. It is based on the original port assignment logic suggestion from RFC 959 - citing from section 5.2. CONNECTIONS:

The server shall initiate the data connection from his own default data port (L-1) using the specified user data port.

Rebex File Server follows the classic Unix ftpd convention and binds the outgoing data connection to control_port - 1 (port 20 for the standard case). This mirrors the historical ftp (21) / ftp-data (20) port pairing that's still listed in IANA's service name registry, and some firewalls/NAT devices still rely on this pairing to recognize legitimate active-mode data connections.

However, when the control port is outside the well-known range (1024+), there's no reserved "data port" to fall back to, so the server doesn't try to replicate the port - 1 convention. It just lets the OS assign a random ephemeral source port for the outgoing data connection, like a normal client-side connection would get.

We generally recommend using passive mode of transfer (PASV and EPSV commands). In passive mode, the client initiates the data connection to the server, which avoids most of the issues around servers having to open arbitrary/privileged outbound ports and makes firewall/NAT traversal more predictable.

If you need to restrict the range of ports used for data connections (e.g. to limit range of ports on your firewall), you can use FileServerSettings.FtpDataPortRange.

If your server sits behind NAT, you can also explicitly specify the address reported to clients (in PASV responses) using FileServerSettings.FtpServerAddress.

---

Implementation detail: when using port - 1 logic, the SocketOptionName.ReuseAddress is set on the data socket.