FTP

FTP is one of the oldest application protocols on the Internet, made for one job: moving whole files between a client and a server — uploading and downloading. Long before the web, if you wanted to fetch a program or publish a document to a server, you used FTP. Its lasting lesson is a design choice it pioneered: it splits its work across two separate connections, one for talking and one for carrying the goods.

Here is the unusual part. FTP uses a control connection and a data connection. The client first opens a control connection to the server (TCP port 21) and over it sends commands as readable text — log in, change directory, list files, "please send me report.pdf." But the file contents themselves do not travel on that control connection. For each transfer, a separate data connection is opened just to carry the file's bytes, and it closes when that file is done; the control connection stays open the whole session, coordinating. This is called out-of-band control: the commands and the data ride on different channels. (The detail of who opens the data connection is what splits FTP into "active" and "passive" modes, which matters because firewalls and NAT struggle with the active style.)

Separating control from data is a clean idea — you can issue a new command or abort a transfer while a file is in flight — and it influenced later protocol designs. But classic FTP has a serious, honest flaw: it sends everything, including your username and password, in plain readable text with no encryption. Anyone watching the network can read your credentials. That is why plain FTP has largely been replaced for anything sensitive by secure alternatives such as SFTP (file transfer over SSH) and FTPS (FTP wrapped in TLS), and why you rarely meet bare FTP on the modern web.