# WHATPORT(21)

## NAME

port 21 — FTP — FTP's command channel — logins and commands in cleartext, with data moving on a second connection.

Protocol: TCP  
IANA registry

## DESCRIPTION

A client connects to 21, gets a text banner, and sends commands like USER, PASS, LIST and RETR; the server answers with three-digit codes. Every byte, including the password, is plaintext unless the session upgrades with AUTH TLS (RFC 4217). It appears on scans from vendor appliances, printers, build drops, and legacy anonymous mirrors. Its banner leaks the exact server and version, which is why it is a favorite first target on any scan.

## EXPOSURE

**Expose with care.** Acceptable internet-facing only as anonymous read-only or with TLS enforced; authenticated cleartext FTP on a public IP hands over credentials.

## CHECK

```sh
printf 'QUIT\r\n' | nc -v ftp.gnu.org 21
```

## SEE ALSO

- spec — [RFC 959 — File Transfer Protocol (FTP)](https://www.rfc-editor.org/rfc/rfc959.html) (rfc-editor.org)
- spec — [RFC 4217 — Securing FTP with TLS](https://www.rfc-editor.org/rfc/rfc4217.html) (rfc-editor.org)
- source — [ProFTPD source repository](https://github.com/proftpd/proftpd) (github.com)
- iana — [IANA Service Name and Transport Protocol Port Number Registry](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml) (iana.org)

---

HTML: <https://whatport.net/21/> · JSON: <https://whatport.net/21.json> · full dataset: <https://whatport.net/ports.json>