>>> The primary problems that the FTP poses to firewalls, NAT devices, and load-balancing devices (all of which will simply be referred to as Ârouting devicesÂ

>>> The primary problems that the FTP poses to firewalls, NAT devices, and load-balancing devices (all of which will simply be referred to as Ârouting devices and not "routers" since gateway machines generally aren't problematic) are: this reminds me how some companies such as Nestle use term "chocolate candy" because in order to call it a chocolate, it actually needs to be a chocolate :) >>>Additional TCP/IP connections are used for data transfers; >>>Data connections may be sent to random port numbers; >>>Data connections may originate from the server to the client, as well as originating from the client to the server; >>>Data connections destination addresses are negotiated on the fly between the client and server over the channel used for the control connection; >>>The control connection is idle while the data transfer takes place on the data connection. >What a protocol. These behaviors thought allows things like FXP, where you can actually transfer files from one FTP server to another without it having to go through you (this is especially useful when those FTP servers are on a fast connection, but you're not). The part about using random ports, is half truth, by default transfers were happening on port 20. This port was opened on the client (to avoid mix-ups when multiple users are accessing the same server) and server connected to it. As NAT was introduced this (an in fact NAT made a lot of things difficult, I'm glad IPv6 doesn't have NAT) became difficult so a PASV (passive) mode was introduced, where the server picked a random port and waited for client to connect to it. The passive mode made firewalling a bit harder, but not that difficult. As an admin you could control the range of ports used by the server, also firewalls such as IPFilter had built-in FTP proxy[1]. It's also possible to do this in other firewalls but it might require an external ftp proxy rules. [1] http://www.freebsdwiki.net/index.php/IPFILTER_(IPF)_Firewall#FTP_Special_NAT_Handling http://www.freebsdwiki.net/index.php/IPFILTER_(IPF)_Firewall...