FTP's command channel — logins and commands in cleartext, with data moving on a second connection.
A client connects to 21, gets a text banner, and sends commands like USER, PASS, LIST and RETR; the server answers with three-digit codes. Every byte, including the password, is plaintext unless the session upgrades with AUTH TLS (RFC 4217). It appears on scans from vendor appliances, printers, build drops, and legacy anonymous mirrors. Its banner leaks the exact server and version, which is why it is a favorite first target on any scan.
Expose with care
Acceptable internet-facing only as anonymous read-only or with TLS enforced; authenticated cleartext FTP on a public IP hands over credentials.
$ printf 'QUIT\r\n' | nc -v ftp.gnu.org 21Seen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.