Port 20: FTP-DATA
Port 20 is the FTP data channel. In active-mode FTP the server opens a connection back to the client from port 20 to move the actual file bytes, while commands travel separately over port 21.
| Port number | 20 |
|---|---|
| Service | File Transfer Protocol (data) |
| Protocol | TCP |
| Category | File transfer |
| Default encryption | No |
| IANA service name | ftp-data |
| IANA transports | TCP, UDP, SCTP |
| Used in practice | TCP |
Why does FTP need two ports?
FTP separates control from data. The client opens a long-lived control connection to port 21 and keeps it open for the whole session, issuing commands and reading replies. Each file transfer or directory listing then gets its own separate data connection, which is what port 20 is for.
In active mode the server initiates that data connection outbound from its port 20 to a port the client nominated. That is the arrangement port 20 exists for, and it is also why active FTP breaks so often: the client is behind NAT or a firewall that will not accept an inbound connection it did not ask for.
Passive mode was invented to solve exactly that. The client asks the server to listen instead, the server nominates a high port, and the client connects out to it. In passive mode, which is now the default nearly everywhere, port 20 is not used at all. So if you are troubleshooting a modern FTP setup and nothing is happening on port 20, that is expected.
Which ports are related to port 20?
The port a reader usually needs next is the encrypted or plaintext twin of this one, so those are listed first rather than buried in a generic list.
| Port | Relationship | Why it matters |
|---|---|---|
| 21 | companion | The control channel. Commands like USER, PASS and RETR go to port 21; only the file data uses port 20. |
| 989 | encrypted | The FTPS data channel, the same job wrapped in implicit TLS. |
| 22 | superseded by | SFTP over SSH replaces the whole two-port arrangement with one encrypted connection. |
What commonly listens on port 20?
- vsftpd, ProFTPD and Pure-FTPd on Linux
- FileZilla Server and IIS FTP on Windows
- Network appliances that still accept firmware uploads over FTP
How do I check whether port 20 is open?
Port 20 carries TCP, so a connection either completes its handshake or it does not, which makes the check definitive.
| Question | Command | What to know |
|---|---|---|
| Is it open on a remote host? | nc -vz example.com 20 | A TCP handshake either completes or it does not, so netcat gives a definitive answer in one line. |
| Same check on Windows | Test-NetConnection example.com -Port 20 | Built into PowerShell. TcpTestSucceeded in the output is the answer; telnet is not installed by default on modern Windows. |
| What is listening locally? | ss -tlnp | grep ':20 ' | Lists the process bound to port 20 on Linux. On macOS use lsof -nP -iTCP:20 -sTCP:LISTEN, on Windows netstat -ano | findstr :20 |
Replace example.com with the host you are testing. A blocked port and a port with nothing listening on it look identical from the outside, so if a service should be running, check locally before blaming the firewall.
Frequently asked questions
Is port 20 used in passive FTP?
No. Port 20 is only used for active-mode data connections, where the server connects outbound to the client. In passive mode the server listens on a high, dynamically chosen port instead and port 20 stays idle, which is the case for most FTP deployments today.
What is the difference between port 20 and port 21?
Port 21 is the control channel that carries FTP commands and replies for the whole session. Port 20 carries only the file contents and directory listings, on a separate connection opened per transfer, and only in active mode.
What is port 20 used for?
Port 20 is the FTP data channel. In active-mode FTP the server opens a connection back to the client from port 20 to move the actual file bytes, while commands travel separately over port 21.
Is port 20 TCP or UDP?
IANA assigns port 20 on TCP, UDP, SCTP. In practice it carries TCP. IANA lists ftp-data on TCP, UDP and SCTP, but FTP is a TCP protocol and you will not see UDP traffic on port 20 in practice.
Is port 20 secure?
Port 20 is not encrypted by default. Where possible, use an encrypted alternative or tunnel it over TLS or a VPN.
Should I open port 20 on my firewall?
Only if you specifically need FTP-DATA. Expose it to the smallest set of trusted sources, and never open database or Windows-service ports to the whole internet.