TCP Port 21 – FTP (File Transfer Protocol)
Port 21 is the standard control port for FTP, the File Transfer Protocol used since the early 1970s to transfer files between computers across a network. FTP predates the public internet and predates HTTP by two decades; it was specified in its current form by RFC 959 in 1985 and remained the default file transfer mechanism on the internet for most of the next two decades. Today it is largely a legacy protocol, retained for backward compatibility with older systems but rarely a deliberate first choice for new deployments.
FTP is unusual in that it uses two separate TCP connections rather than one. The control connection on port 21 carries the commands (LIST, RETR, STOR, etc.) and their responses; the actual file data travels on a different connection that uses a different port. In active mode, the data connection runs from port 20 on the server to an ephemeral port on the client. In passive mode, the client opens a data connection to an ephemeral port on the server. This two-port architecture made FTP notoriously difficult to traverse through firewalls and was a major reason the protocol fell out of favor as alternatives matured.
Modern file transfer overwhelmingly uses HTTPS-based mechanisms (browser downloads, cloud storage APIs, web-based file sharing services) and SSH-based mechanisms (SFTP, SCP) on port 22. Where FTP still appears, it is most often legacy hosting providers offering FTP access for historical reasons, internal corporate file servers that have not been modernized, or specific embedded devices that ship with FTP support.
Outbound TCP/21 from end-user devices is uncommon in 2026. Inbound TCP/21 from the public internet to any host is unusual and is generally a sign of legacy infrastructure that has not been migrated to a modern alternative.
About TCP Port 21
Port 21 is registered with the Internet Assigned Numbers Authority (IANA) for ftp. The IANA description reads: ‘File Transfer Protocol [Control]’.
Security Considerations
FTP transmits credentials and file contents in plaintext by default. A user logging in over port 21 sends their username and password unencrypted across the network, where any device on the path can read them. FTP also has no built-in protection for the file contents themselves; uploaded and downloaded files traverse the network in clear. FTPS (FTP over TLS, sometimes called FTP-SSL) and SFTP (which is actually a separate protocol that uses SSH) both address these gaps, but neither runs on port 21 by default. Plain FTP on port 21 is best understood as a legacy protocol with the same plaintext-credentials problem as Telnet.
Our data shows 174 IDS rules referencing port 21, with attempted-admin and attempted-recon classtypes leading the count. The sample rules preserve a long history of late-1990s and early-2000s FTP attacks: the ADMw0rm worm targeting wu-ftpd, CEL command overflows, attempts to access .forward and .rhosts files (a classic Unix backdoor technique), and scanner signatures for the adm and iss security tools of that era. Most of these threats are no longer active in the wild, but the rules remain useful for detecting attacks against unpatched legacy servers.
Several malware families also appear in the dataset. Emotet (MITRE S0367) accounts for 12 rules tied to port 21, primarily reflecting Emotet variants that download additional payloads from FTP servers or exfiltrate stolen data to attacker-controlled FTP endpoints rather than using port 21 as a primary command-and-control channel. The Critroni ransomware family (also known as CTB-Locker) appears in our data, along with the HawkEye keylogger. As with most of the legacy protocol ports in our dataset, present-day port 21 activity tends to reflect post-compromise behaviors rather than ongoing direct attacks against FTP itself.
Common practice today is to migrate away from plain FTP entirely. SFTP on port 22 (which is actually SSH-based file transfer, not related to the FTP protocol) is the standard modern replacement. FTPS may be acceptable for legacy compatibility where SFTP is not supported. Where plain FTP must continue to run, restrict it to internal network ranges, change all default credentials, and accept that any password used over plain FTP is effectively public information.
Inbound TCP/21 from the public internet is uncommon in 2026. Outbound TCP/21 from a typical end-user device to an unfamiliar destination is also uncommon and may indicate either a legacy file-transfer task or, in some malware contexts, automated payload retrieval or data exfiltration to an attacker-controlled FTP server.
IDS Rule References
159 IDS / security rules reference TCP port 21. Presence in IDS rules does not mean traffic on this port is malicious. These are patterns security tools monitor.
Rule categories (top 6): attempted-admin (42), attempted-recon (29), bad-unknown (13), misc-attack (12), trojan-activity (11), misc-activity (9).
Sample rule descriptions for TCP port 21:
- PROTOCOL-FTP ADMw0rm ftp login attempt
- SERVER-OTHER NextFTP client overflow
- PROTOCOL-FTP .forward
- PROTOCOL-FTP .rhosts
- PROTOCOL-FTP CWD ~root attempt
Malware Activity
Some malware indicators are observed on this port.
10 of 159 IDS rules for TCP port 21 involve malware activity.
Families observed (top 5): Black (1), Critroni (1), HawkEye (1), MSIL_Golroted_B (1), Predator (1).
Data Sources
This information is compiled from: IANA Service Name and Transport Protocol Port Number Registry, Emerging Threats Open Ruleset (BSD 2-Clause / GPLv2 per SID range), Snort Community Rules (GPLv2), and MITRE ATT&CK (Apache 2.0).