Why does port 20 work for FTP Active Mode?

Question

I was reading: Why port 20 is not used for data channel in FTP passive mode?

Where one answer says:

If you were to connect to the same port (20) every time, the server would not be able to tell, what file do you connect for. The port number serves as a link between a transfer request on the control connection and a data connection. Note that there's no "protocol" on the data connection, that could be used by the client to tell what it asks for. The port number is the only unique information the server has.

If two clients were to request a transfer at the same time, and the server were accepting data connections on the single port, the server would not be able to tell, what file to transfer. Of course, the server could use a client IP for the decision (actually many FTP server do validate that the client IP matches the IP used on the control connection for security).

But this would not work for:

Multiple connections from the same machine (most FTP clients do support parallel transfers/queues). Connection from different machines withing the same (corporate) network, as those have the same external IP.

which makes perfect sense for me.

But, in FTP active mode I learnt that data is served on port 20, so how does the above problem not exist in active mode?

Answer 1

I'm afraid the internet is full of false information about the port 20. Even supposedly reliable sources like Wikipedia are imo unclear on this.

The port 20 is used as a source port (on the server side) of the data connection from server to the client in the active mode. And I'm not even sure if the servers follow this, as it has hardly any significance I know of. The source port information is lost on the first firewall/NAT between the client and the server anyway. For example new versions of FileZilla server do not use port 20 anymore.

It's the destination port (server side in the passive mode, client side in the active mode) that is significant only. In the active mode, the client starts listening on a random port and sends it to the server using PORT command. It's the server that is initiating the connection, so the server knows what the connection is for (the same way the client knows it in the passive mode). When the server connects to the client's random port, the client can tell (based on the port), what file is going to be transferred over that connection (the same way the server knows it in the passive mode). Again, the port 20 has no significance here.

Answer 2

But, In FTP active mode I learnt that data is served on port 20, so how the above problem doesn't exist in active mode?

In FTP active mode, the server connects to a (ephemeral) port that the client has previously provided using the port command (see Martin's answer). On both sides, the connection is uniquely identified by the ClientIP:ClientPort tuple.

Historically, it was also possible that the client used its 'default' port to receive/send data, the one it used to connect to the server's service port 21. To distinguish the data connection from the service connection, the server needs to use a different source port. Short of arbitrating that, the server uses its service port number minus one.

Of course, this may today very well be considered exotic, especially from a security POV. FTP active mode has largely fallen out of use due to the cumbersome reverse server→client connection.