TCP Port 21 – FTP (File Transfer Protocol)

Port 21 is the standard control port for FTP, the File Transfer Protocol used since the early 1970s to transfer files between computers across a network. FTP predates the public internet and predates HTTP by two decades; it was specified in its current form by RFC 959 in 1985 and remained the default file transfer mechanism on the internet for most of the next two decades. Today it is largely a legacy protocol, retained for backward compatibility with older systems but rarely a deliberate first choice for new deployments.

FTP is unusual in that it uses two separate TCP connections rather than one. The control connection on port 21 carries the commands (LIST, RETR, STOR, etc.) and their responses; the actual file data travels on a different connection that uses a different port. In active mode, the data connection runs from port 20 on the server to an ephemeral port on the client. In passive mode, the client opens a data connection to an ephemeral port on the server. This two-port architecture made FTP notoriously difficult to traverse through firewalls and was a major reason the protocol fell out of favor as alternatives matured.

Modern file transfer overwhelmingly uses HTTPS-based mechanisms (browser downloads, cloud storage APIs, web-based file sharing services) and SSH-based mechanisms (SFTP, SCP) on port 22. Where FTP still appears, it is most often legacy hosting providers offering FTP access for historical reasons, internal corporate file servers that have not been modernized, or specific embedded devices that ship with FTP support.

Outbound TCP/21 from end-user devices is uncommon in 2026. Inbound TCP/21 from the public internet to any host is unusual and is generally a sign of legacy infrastructure that has not been migrated to a modern alternative.

About TCP Port 21

Port 21 is registered with the Internet Assigned Numbers Authority (IANA) for ftp. The IANA description reads: ‘File Transfer Protocol [Control]’.

Security Considerations

FTP transmits credentials and file contents in plaintext by default. A user logging in over port 21 sends their username and password unencrypted across the network, where any device on the path can read them. FTP also has no built-in protection for the file contents themselves; uploaded and downloaded files traverse the network in clear. FTPS (FTP over TLS, sometimes called FTP-SSL) and SFTP (which is actually a separate protocol that uses SSH) both address these gaps, but neither runs on port 21 by default. Plain FTP on port 21 is best understood as a legacy protocol with the same plaintext-credentials problem as Telnet.

The IDS rules referencing port 21 are led by the attempted-admin and attempted-recon classtypes. The sample rules preserve a long history of late-1990s and early-2000s FTP attacks: the ADMw0rm worm targeting wu-ftpd, CEL command overflows, attempts to access .forward and .rhosts files (a classic Unix backdoor technique), and scanner signatures for the adm and iss security tools of that era. Most of these threats are no longer active in the wild, but the rules remain useful for detecting attacks against unpatched legacy servers.

Several malware families also appear in the dataset. Emotet (MITRE S0367) appears repeatedly in rules tied to port 21, primarily reflecting Emotet variants that download additional payloads from FTP servers or exfiltrate stolen data to attacker-controlled FTP endpoints rather than using port 21 as a primary command-and-control channel. The Critroni ransomware family (also known as CTB-Locker) appears in our data, along with the HawkEye keylogger. As with most of the legacy protocol ports in our dataset, present-day port 21 activity tends to reflect post-compromise behaviors rather than ongoing direct attacks against FTP itself.

Common practice today is to migrate away from plain FTP entirely. SFTP on port 22 (which is actually SSH-based file transfer, not related to the FTP protocol) is the standard modern replacement. FTPS may be acceptable for legacy compatibility where SFTP is not supported. Where plain FTP must continue to run, restrict it to internal network ranges, change all default credentials, and accept that any password used over plain FTP is effectively public information.

Inbound TCP/21 from the public internet is uncommon in 2026. Outbound TCP/21 from a typical end-user device to an unfamiliar destination is also uncommon and may indicate either a legacy file-transfer task or, in some malware contexts, automated payload retrieval or data exfiltration to an attacker-controlled FTP server.

IDS Rule References

159 IDS / security rules reference TCP port 21. Treat that number as context, not a danger score. Many detection rules are written against groups of ports rather than one service, web ports especially, so common web alternate ports inherit large counts while genuinely sensitive services can show few rules or none. Presence in IDS rules does not mean traffic on this port is malicious.

Rule categories (top 6): attempted-admin (42), attempted-recon (29), bad-unknown (13), misc-attack (12), trojan-activity (11), misc-activity (9).

Sample rule descriptions for TCP port 21:

• PROTOCOL-FTP ADMw0rm ftp login attempt
• SERVER-OTHER NextFTP client overflow
• PROTOCOL-FTP .forward
• PROTOCOL-FTP .rhosts
• PROTOCOL-FTP CWD ~root attempt

Malware Rule References

A small share of the IDS rules that reference this port are malware related.

10 of the 159 IDS rules that reference TCP port 21 are malware related. That describes detection coverage across the whole internet, not anything about your machine or your network.

Families observed (top 5): Black (1), Critroni (1), HawkEye (1), MSIL_Golroted_B (1), Predator (1).

Data Sources

This information is compiled from: IANA Service Name and Transport Protocol Port Number Registry, Emerging Threats Open Ruleset (BSD 2-Clause / GPLv2 per SID range), Snort Community Rules (GPLv2), and MITRE ATT&CK (Apache 2.0).