What's the difference between active mode and passive mode in FTP, and why does passive mode usually win?

Active mode: server initiates the data connection back to the client. Passive: client initiates both. Passive works through NAT and firewalls; active doesn't.

Two connections, two modes:

FTP uses two separate TCP connections:

• Control connection (port 21) — commands and responses
• Data connection — actual file bytes

The "mode" determines who initiates the data connection.

Active mode (default in old clients):

1. Client opens control connection: client:rand → server:21
2. Client tells server: "I'll listen on client:N for the data"
3. Server connects BACK: server:20 → client:N    ← reverse direction!

Why active mode breaks:

• NAT problem: The server-initiated connection arrives at the NAT, which has no rule for it — it gets dropped
• Firewall problem: Most client-side firewalls block incoming connections by default
• The "client IP" that FTP sends in the command is the internal IP, not the public NAT IP — so even if the firewall let it through, it goes to the wrong address

Passive mode (default in modern clients):

1. Client opens control connection: client:rand → server:21
2. Client says: PASV ("you tell me the data port")
3. Server replies: "Connect to server:M for data"
4. Client opens data connection: client:rand2 → server:M    ← both client-initiated!

Why passive works:

Both connections are outbound from the client → NAT and firewalls handle them like any normal browsing traffic.

A practical note:

Windows command-line ftp does not support passive mode by default — that's why you switch to WinSCP, which does. Linux's ftp and most modern clients use passive by default.

The PASV response format:

227 Entering Passive Mode (192,168,1,5,200,42)
                          └─server IP─┘ └port┘
                                          (200×256 + 42 = 51242)

Tip: When troubleshooting "I can connect to FTP but listing/downloads hang," it's almost always active vs passive mode mismatch. Switch to passive in your client settings.

Go deeper:

• File Transfer Protocol — active vs passive (Wikipedia) — the two data-connection modes, the PORT/PASV commands, and why NAT/firewalls favour passive.