Visual RFC.
ALL RFCs / RFC 2428
Read the RFC ↗
RFC 2428 / FTP DATA CONNECTIONS

Distinguish 200 acceptance from a 522 protocol error

03

A three-machine proxy FTP controller can give sending server A the receiving server B’s listening endpoint. Server support must still match.

RFC 2428 · § 2EXAMPLE
4 / 4
04
A later file command triggers data

The positive branch has B prepared for STOR and a later authorized RETR at A. A opens data TCP to B:5282 and sends the illustrated file bytes.

Distinguish 200 acceptance from a 522 protocol errorThe positive branch has B prepared for STOR and a later authorized RETR at A. A opens data TCP to B:5282 and sends the illustrated file bytes.A later file command triggers dataController CServer AServer Blistens: 5282Three-machine fixture · B already prepared to receiveLater authorized RETR at Adata TCP + file bytes → BB endpoint: [2001:db8::20]:5282

Key idea: A protocol-support reply is not a file transfer or permission to connect anywhere.

Terms
FTP
File Transfer Protocol. Its control connection carries commands; a separate data connection carries a file or directory listing.
Client / server
The client sends FTP commands. Which side opens the data TCP connection is a separate choice.
Address family
The network protocol number: 1 for IPv4 and 2 for IPv6 in these examples.
Passive mode
The server listens for a data TCP connection that the connecting peer opens.

Look up a term in the glossary ↗

Rules & examples
  • This is a three-machine proxy FTP fixture, not the ordinary same-two-machine case that §4 requires to use EPSV. B’s listening endpoint was obtained separately; file-operation authorization and B’s receiving setup are assumed.
  • Upon a valid EPRT command the server MUST return 200. If the requested network protocol is unsupported, 522 identifies that failure. Its text MUST contain a parenthesized comma-separated list of supported family numbers.
  • The human text before the 522 protocol list MUST NOT contain parentheses and SHOULD explain that the requested protocol is unsupported. Example: 522 Network protocol not supported (1). The final period here is prose, not a reply byte.
  • The negative and positive replies shown are separate server-support cases. A 200 setup acknowledgement alone does not move file bytes. The selected successful branch later uses an authorized RETR at A, with B already prepared to receive, before the A-to-B data connection/file flow.
  • RFC 2577 §§2–3 discusses FTP bounce abuse and server policy. Merely naming B in EPRT does not prove B’s identity or authorize a third-party connection; these extensions are not an encryption or authentication mechanism.

Documentation addresses and chosen listening ports. Each chapter is a separate bounded example; FTP authentication, authorization, file commands and transfer replies are not a complete FTP implementation here. EPRT/EPSV provide no encryption or guaranteed reachability.

Sources
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
New to this? Start hereA quick picture + helpful background
commandsfile bytes

Commands arrange a separate file connection

Imagine arranging a delivery by phone, then opening a separate delivery entrance. EPSV asks the server to listen; EPRT can describe another receiving endpoint in a proxy setup. The analogy separates arranging a connection from moving the file and does not promise access through a firewall.

Helpful first, if these ideas are unfamiliar

These pictures are analogies to help you learn. The linked RFC explains the actual rules.

Related RFCs and changes

“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.

All chapters in RFC 2428

Drawing view

Scroll the drawing to see every part. Playback controls stay above it.

RFC 9700 / CHAPTERS

Chapters

For full details, tables, algorithms, and exceptions, read the original RFC.

RFC status and corrections ↗