Layer 7 File Transfer Protocols: FTP and SMB

Layer 7 file transfer protocols operate at the application layer of the OSI model, enabling file transfers and resource sharing across networks. FTP (File Transfer Protocol) and SMB (Server Message Block) are two fundamental protocols that serve different purposes: FTP focuses on client-server file transfers, while SMB enables seamless file and printer sharing across networked devices. Understanding these protocols is essential for managing network resources and addressing their inherent security vulnerabilities.

Key Points

• FTP uses a client-server architecture with two separate connections: control (port 21) and data (port 20 in active mode)
• SMB integrates directly into operating systems, allowing shared folders to appear as local directories
• Both protocols operate at Layer 7 (Application Layer) of the OSI model
• Classic FTP transmits credentials in plaintext, requiring secure alternatives like FTPS or SFTP
• SMB vulnerabilities have been exploited by major malware attacks, including WannaCry ransomware
• Port usage varies: FTP uses TCP 21/20, while modern SMB uses TCP 445

---

FTP: File Transfer Protocol

How FTP Works

FTP is designed specifically for transferring files between a client and server over IP networks. It follows a strict client-server model where users run FTP client software (like FileZilla) to connect to remote servers for uploading or downloading files.

Key characteristics:

• Operates over TCP for reliable delivery
• Requires authentication (username and password)
• Supports commands like LIST, GET, and PUT
• Uses two separate connections simultaneously

The Two-Connection Architecture

FTP's unique design uses two distinct channels:

Connection Type	Port	Purpose
Control Connection	TCP 21	Sends commands, authentication, and administrative instructions
Data Connection	TCP 20 (active mode) or random high port (passive mode)	Transfers actual files and directory listings

Important: Port 20 is primarily used in active FTP mode. In passive mode, the server opens a random high-numbered port for data transfer instead.

FTP Communication Flow

Client                         FTP Server
   |                                |
   |-------- Connect (TCP 21) ----->|
   |<------- Authentication --------|
   |-------- Commands (LIST) ------>|
   |<------- Responses -------------|
   |-------- Data Transfer -------->|
   |<------- File Content ----------|

FTP Security Considerations

Classic FTP is inherently insecure:

• Credentials transmitted in plaintext
• File contents unencrypted during transfer
• Vulnerable to man-in-the-middle attacks

Secure alternatives:

• FTPS (FTP Secure): FTP with SSL/TLS encryption
• SFTP (SSH File Transfer Protocol): Different protocol using SSH for secure transfers

---

SMB: Server Message Block

What is SMB?

SMB is an application-layer protocol designed for file sharing, printer access, and network resource communication across local networks. Unlike FTP's explicit file transfer approach, SMB integrates seamlessly into operating systems, making shared network resources appear as local folders.

Primary uses:

• Accessing shared folders on network drives
• Connecting to network printers
• Sharing resources between workstations and servers
• Enabling collaborative file access in enterprise environments

SMB Technical Details

• Default port: TCP 445 (modern implementations)
• Architecture: Network file system style
• Environment: Primarily local networks and enterprise settings
• Integration: Built directly into Windows, with support in Linux (Samba) and macOS

SMB Security Risks

SMB has been a frequent target for malware due to its widespread use and network access capabilities.

WannaCry Ransomware Case Study:

1. Malware exploited an unpatched SMB vulnerability (EternalBlue)
2. Infected machines scanned networks for other vulnerable SMB services
3. Ransomware automatically propagated through file-sharing mechanisms
4. Thousands of organizations worldwide were compromised within hours

Critical Security Practice: Always keep SMB services updated with the latest security patches to prevent exploitation.

---

FTP vs SMB Comparison

Feature	FTP	SMB
Primary Purpose	File transfer between client and server	File and resource sharing across networks
Architecture	Client-server model	Network file system
Typical Environment	Internet-facing servers, remote access	Local networks, enterprise environments
User Experience	Explicit transfer operations	Transparent access (appears as local folders)
Default Ports	TCP 21 (control), 20 (data)	TCP 445
Security Risks	Plaintext credentials (classic FTP)	Vulnerability to worms and ransomware
Authentication	Username/password per session	Often integrated with domain authentication

---

Practical Applications

FTP Use Case: Website Deployment

Scenario: Uploading website files to a web hosting server

1. Open FTP client software (FileZilla, WinSCP)
2. Connect to server using hostname and port 21
3. Authenticate with provided credentials
4. Navigate to web directory (e.g., /public_html)
5. Upload HTML, CSS, and image files through data connection
6. Verify files transferred successfully

SMB Use Case: Office File Sharing

Scenario: Accessing company documents on a network drive

1. IT administrator creates shared folder on file server
2. Employees map network drive (e.g., \\fileserver\documents)
3. Shared folder appears as drive letter (Z:) on workstations
4. Users access files as if stored locally
5. Changes sync automatically across network
6. Permissions control who can read, write, or delete files

---

Common Mistakes and Misconceptions

Port 20 confusion:

• Port 20 is not always used for FTP data transfers
• Only applies to active mode; passive mode uses random high ports
• Many firewalls require passive mode configuration

FTP security assumptions:

• Classic FTP is not secure by default
• Credentials and data transmitted in cleartext
• Always use FTPS or SFTP for sensitive data

Protocol confusion:

• SMB is not a file transfer protocol like FTP
• SMB provides transparent network file system access
• Different use cases require different protocols

SMB patch management:

• Ignoring updates exposes networks to known exploits
• SMB vulnerabilities enable rapid malware propagation
• Regular patching is critical for network security

---

Key Takeaways

• FTP and SMB are Layer 7 protocols serving different file-sharing needs
• FTP uses dual connections: control (TCP 21) and data (TCP 20 or passive ports)
• SMB enables transparent file sharing across networks using TCP 445
• Classic FTP lacks encryption; use FTPS or SFTP for secure transfers
• SMB vulnerabilities have enabled large-scale attacks like WannaCry
• Regular patching and security updates are essential for both protocols
• Choose the appropriate protocol based on use case: FTP for explicit transfers, SMB for network file systems

---

Learn More

Official Documentation:

• RFC 959: File Transfer Protocol (FTP)
• Microsoft SMB Protocol Documentation

Educational Resources:

• IETF (Internet Engineering Task Force) protocol specifications
• Cisco Networking Academy: Application Layer Protocols
• Cloudflare Learning Center: Network Protocol Explanations

Security Resources:

• Microsoft Security Response Center: SMB vulnerability advisories
• NIST Cybersecurity Framework: Secure file transfer guidelines
• SANS Institute: FTP and SMB security best practices