{
  "port": 20,
  "protocol": "tcp",
  "service": "FTP data",
  "oneLiner": "The data channel for classic active-mode FTP; the file bytes move here, not on 21.",
  "whatItIs": "An active-mode FTP server opens a connection *from* its own port 20 back to a client-chosen port to carry directory listings and file contents, while commands stay on port 21. Passive mode, which most modern clients and NATs use, abandons port 20 entirely for high ephemeral ports. On a scan you rarely see 20 listening; you see it in packet captures or firewall logs next to an FTP server. Seeing it at all means someone is running active-mode FTP, usually an old appliance or a batch file-transfer job.",
  "exposure": {
    "verdict": "careful",
    "note": "Only meaningful alongside port 21, and it inherits FTP's cleartext problem unless the session negotiated TLS per RFC 4217."
  },
  "checkCommand": "sudo tcpdump -ni any tcp port 20",
  "links": [
    {
      "title": "RFC 959 — File Transfer Protocol (FTP)",
      "url": "https://www.rfc-editor.org/rfc/rfc959.html",
      "kind": "spec"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    },
    {
      "title": "ProFTPD source repository",
      "url": "https://github.com/proftpd/proftpd",
      "kind": "github"
    }
  ]
}