DOCUMENT:Q283679 16-AUG-2001 [iis] TITLE :Information on the IIS File Transmission Protocol (FTP) Service PRODUCT :Internet Information Server PROD/VER::3.0,4.0,5.0 OPER/SYS: KEYWORDS: ====================================================================== ------------------------------------------------------------------------------- The information in this article applies to: - Microsoft Internet Information Server versions 3.0, 4.0, 5.0 ------------------------------------------------------------------------------- SUMMARY ======= Internet Information Server (IIS) with File Transmission Protocol (FTP) installed supports the following connection types: - Active-mode FTP - Passive-mode FTP This article provides information about FTP connections with each of these modes. MORE INFORMATION ================ The IIS-based FTP service (MSFTPSVC) supports both active and passive mode connections, depending on the method that is specified by the client. IIS does not support disabling either active or passive mode connections, due to the lack of such a feature in RFC 959. Unlike HTTP and most other protocols used on the Internet, the FTP protocol uses a minimum of two connections during a session: a half-duplex connection for control, and a full-duplex connection for data transfer. By default, TCP port 21 is used on the server for the control connection, but the data connection is determined by the method that the client uses to connect to the server. Active-mode FTP Connections: Active-mode FTP is sometimes referred to as "client-managed" because the client sends a PORT command to the server (over the control connection) that requests the server to establish a data connection from TCP Port 20 on the server, to the client, using the TCP port that is specified by the PORT command. The FTP client sends the PORT command to the FTP server in the following format: PORT 192,168,0,3,19,243 where the first four comma-seperated values correspond to the octets of the client's IP address, and the fifth and sixth values are the high- and low-order bits of the 16-bit port number. To convert the high- and low-order bits into a (decimal) port number, multiply the fifth value by 256 and add the sixth value to it. In the example above, the TCP port (in decimal) is (256 x 19) + 243 = 5107, so the client is instructing the server to open a data connection to 192.168.0.3:5107. By default, the FTP client chooses an ephemeral port for the data connection port. An ephemeral port is a port that is randomly chosen from the available ports between 1024 and 65535. NOTE: In Windows NT 4.0 and Windows 2000, the valid default ephemeral port range is 1024-5000. Increasing the ephemeral range in Windows NT 4.0 and Windows 2000 requires adding a value to the system registry. For additional information on increasing the default ephemeral range, click the article number below to view the article in the Microsoft Knowledge Base: Q196271 Unable to Connect from TCP Ports Above 5000 The following is a typical sequence for an active-mode FTP connection: +-----------------------------------------------------------------------+ | Instruction | Sent From | Sent To | +-----------------------------------------------------------------------+ | USER MyUserName | 192.168.4.29:8190 | 10.0.0.10:21 | +-----------------------------------------------------------------------+ | PASS MyPassword | 192.168.4.29:8190 | 10.0.0.10:21 | +-----------------------------------------------------------------------+ | CWD / | 192.168.4.29:8190 | 10.0.0.10:21 | +-----------------------------------------------------------------------+ | 250 CWD command successful. | 10.0.0.10:21 | 192.168.4.29:8190 | +-----------------------------------------------------------------------+ | PORT 192,168,4,29,31,255 | 192.168.4.29:8190 | 10.0.0.10:21 | +-----------------------------------------------------------------------+ | 200 PORT command successful. | 10.0.0.10:21 | 192.168.4.29:8190 | +-----------------------------------------------------------------------+ | LIST | 192.168.4.29:8190 | 10.0.0.10:21 | +-----------------------------------------------------------------------+ | | 10.0.0.10:20 | 192.168.4.29:8191 | +-----------------------------------------------------------------------+ | 226 Transfer complete. | 10.0.0.10:21 | 192.168.4.29:8190 | +-----------------------------------------------------------------------+ Passive-mode FTP Connections: Passive-mode FTP is sometimes referred to as "server-managed", because after the client issues a PASV command, the server responds to that PASV instruction with one of its ephemeral ports that will be used as the server-side port of the data connection. After a data connection command is issued by the client, the server connects to the client using the port immediately above the client-side port of the control connection. The following is a typical sequence for a passive-mode FTP connection: +-----------------------------------------------------------------------------------------+ | Instruction | Sent From | Sent To | +-----------------------------------------------------------------------------------------+ | USER MyUserName | 192.168.4.29:7971 | 10.0.0.10:21 | +-----------------------------------------------------------------------------------------+ | PASS MyPassword | 192.168.4.29:7971 | 10.0.0.10:21 | +-----------------------------------------------------------------------------------------+ | CWD / | 192.168.4.29:7971 | 10.0.0.10:21 | +-----------------------------------------------------------------------------------------+ | 250 CWD command successful. | 10.0.0.10:21 | 192.168.4.29:7971 | +-----------------------------------------------------------------------------------------+ | PASV | 192.168.4.29:7971 | 10.0.0.10:21 | +-----------------------------------------------------------------------------------------+ | 227 Entering Passive Mode (192,168,4,29,9,227). | 10.0.0.10:21 | 192.168.4.29:7971 | +-----------------------------------------------------------------------------------------+ | LIST | 192.168.4.29:7971 | 10.0.0.10:21 | +-----------------------------------------------------------------------------------------+ | | 10.0.0.10:2531 | 192.168.4.29:7972 | +-----------------------------------------------------------------------------------------+ | 226 Transfer complete. | 10.0.0.10:21 | 192.168.4.29:7971 | +-----------------------------------------------------------------------------------------+ Common Problems Encountered With FTP: The most common problem encountered when you use FTP over the Internet results when you attempt transfers through a Network Boundary Securing Device (NBSD) such as a proxy, firewall, or Network Address Translation (NAT) device. In most cases the NBSD allows the control connection to be established over TCP 21 (that is, the user can successfully log on to the FTP server), but when the user attempts a data transfer such as DIR, LS, GET, or PUT, the FTP client appears to stop responding because the NBSD is blocking the data connection port that is specified by the client. If the NBSD supports logging, you can verify port blocking by reviewing the deny/reject logs on the NBSD. In addition to causing problems for NBSD administrators, FTP is commonly misunderstood as a secure means for transferring data, because the FTP server can be configured to require a valid username and password combination prior to granting access. Users should be aware that neither the credentials specified at logon nor the data itself is encrypted or encoded in any way. All FTP data can be easily intercepted and analyzed by any station on any network between the FTP client and FTP server. FTP Clients Provided by Microsoft: The following table lists the FTP clients provided by Microsoft, and the connection mode that each client supports: +----------------------------------------------------------+ | FTP Client | Transfer Mode | +----------------------------------------------------------+ | Command-line | Active (non-passive) | +----------------------------------------------------------+ | Internet Explorer 5.1 and earlier | Passive | +----------------------------------------------------------+ | Internet Explorer 5.5 and later | Both | +----------------------------------------------------------+ | FrontPage ver.1.1 to Windows XP | Active | +----------------------------------------------------------+ File Transfer Alternatives: Because of the NBSD configuration issues and security concerns with FTP, several alternatives to standard FTP are used. One common alternative to FTP is the use of HTTP as a file transfer method, because most firewalls allow HTTP connections over TCP 80 and HTTPS connections over TCP 443. Although Microsoft has supported HTTP-based file transfers for several years in products such as the FrontPage Server Extensions and the Posting Acceptor, the recognized standard for HTTP file transfers is WebDAV, the HTTP extensions for distributed authoring and versioning. Defined by RFC 2518, WebDAV is built into IIS 5.0, and allows the user to use WebDAV shares (that is, folders that are published on a WebDAV-enabled Web server) in much the same way that network shares are used, provided that the connection is made by a client that is capable of communicating with WebDAV (such as Internet Explorer 5.0 and later). NOTE: For more information on RFC 2518, see the following Web site: RFC 2518 http://rfc.net/rfc2518.html Because the FTP service in IIS does not support FTP over Secure Sockets Layer (SSL), if secure communications are important, and FTP is the desired transfer protocol (as opposed to using WebDAV over SSL), consider using FTP over an encrypted channel such as a Virtual Private Network that is secured with Point-to-Point Tunneling Protocol or IPSec. For more information on FTP over SSL, see RFC 2228. REFERENCES ========== Additional FTP Resources The following resources contain more in-depth information about the File Transfer Protocol service: RFC 959 - File Transfer Protocol (FTP) http://rfc.net/rfc959.html Running Microsoft® Internet Information Server http://mspress.microsoft.com/books/1270.htm Authors: Leonid Braginski and Matthew Powell ISBN: 1-57231-585-7 Publisher: Microsoft Press, July 1998 For more information about the File Transfer Protocol, see the "FTP Reviewed" article on the following Codetalker Web site: http://www.codetalker.com/whitepapers/FTP-review.html The third-party contact information included in this article is provided to help you find the technical support you need. This contact information is subject to change without notice. Microsoft in no way guarantees the accuracy of this third-party contact information. WebDAV, WebFolder, and MSIPP Resources The following resources contain more in-depth information about WebDAV, WebFolders, and the Microsoft Internet Publishing Provider: Distributed Authoring and Versioning Extensions for HTTP Enable Team Authoring http://www.microsoft.com/msj/defaulttop.asp?page=/msj/0699/dav/davtop.htm IETF WEBDAV Working Group http://www.ics.uci.edu/pub/ietf/webdav/ WebDAV in 2 Minutes http://www.fileangel.org/docs/DAV_2min.html MSDN Web Storage System Center http://msdn.microsoft.com/WSS/ For additional information, click the article numbers below to view the articles in the Microsoft Knowledge Base: Q290111 HOWTO: Move or Copy Folder Items with WebDAV Q245359 HOWTO: Open Documents Using Internet Publishing Provider Q248501 SAMPLE: Using Rosebud.exe with OLE DB Provider for Internet Publishing from Visual C++ Q195851 How to Install and Use Web Folders in Internet Explorer 5 Resources for Securing Network Connections The following resources contain more in-depth information on how to secure an IP network, which can provide additional security to protect information that is transmitted by using FTP: Point-to-Point Tunneling Protocol http://www.microsoft.com/windows2000/techinfo/reskit/samplechapters/inbe/inbe_vpn_naxe.asp For more information, see the following articles in the Microsoft Knowledge Base: Q161410 How to Set Up a Private Network Over the Internet Using PPTP Q231585 Overview of Secure IP Communication with IPSec in Windows 2000 Additional query words: iis 5 vpn pptp ====================================================================== Keywords : Technology : kbiisSearch kbiis500 kbiis400 kbiis300 Version : :3.0,4.0,5.0 Issue type : kbinfo ============================================================================= THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY. Copyright Microsoft Corporation 2001.