Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Test the FTP server’s TCP control endpoint before changing credentials or client settings. In Windows PowerShell run Test-NetConnection -ComputerName ftp.example.com -Port 21 and read TcpTestSucceeded. On Linux or macOS run nc -vz ftp.example.com 21. A successful handshake proves that port 21 is reachable from that network; it does not prove that login, directory listings, or transfers will work, because FTP uses a separate data connection.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What port 21 actually tells you
The Internet Assigned Numbers Authority assigns TCP port 21 to FTP’s control service. The control connection carries the banner, login exchange, commands, and replies. File listings and file contents use a second data connection.
That split explains a common misleading result: an FTP client can connect, show a welcome banner, and accept a password while directory listing or a download hangs. Port 21 is reachable in that case, but the data-channel connection is not completing. Conversely, a failed port-21 probe prevents the control session from starting, so there is no point debugging usernames or passwords until basic reachability is established.
- Control channel: the client connects to the server’s TCP port 21.
- Data channel: a separate connection carries listings and transfers. In passive mode, the server selects a port and tells the client which port to use in a
PASVorEPSVreply.
Every test is tied to a vantage point. A successful probe from a mobile hotspot does not prove that the same destination is reachable from an office network, and a timeout from one client does not identify which firewall or router dropped the packet.
As an Amazon Associate I earn from qualifying purchases.
Run a direct TCP/21 test
Windows PowerShell
- Open PowerShell. Standard user permissions are normally sufficient for an outbound connectivity test.
- Run:
Test-NetConnection -ComputerName ftp.example.com -Port 21 - Record the resolved remote address, the source/interface used, and the value of
TcpTestSucceeded.
Microsoft documents that the -Port value is the port number used to test connectivity to the remote computer. When the result is True, your computer completed a TCP handshake with the address PowerShell selected. It does not authenticate to FTP and does not open a data connection.
To remove DNS from the equation, repeat the command with an address you have verified belongs to the server:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →#1 Best Overall
- 40 Gbps 2000 Mhz High Speed: The Cat 8 ethernet cable support max. 40 Gbps data transfer and 2000 MHz Brandwith, ideal for gaming and streaming, greatly improving upload and download speed, sound, image and resolution quality
- Excellent Anti-interference: The ethernet cable comes with 4 shielded foiled twisted pairs (F/FTP), pure copper core and gold-plated RJ45 connector, reducing interference, noise and crosstalk, making network speed faster and more stable
- Marvelous Durability: Internet cable wrapped with quality cotton braided cord, which makes the LAN cable stronger and more durable. The test proves that this internet cable can be bent at least 10000 times without broken, very suitable for long-term use
- PoE Supported: All lengths of ethernet cord can support the PoE power supply function except 65ft. You don't need additional power supply when installing a PoE camera, which is very convenient and safe
- Wide Compatibility: With the RJ45 Connector, network cable can be perfectly compatible with computers, laptops, modems, routers, PS5, X-Box and other networking devices. It can also be fully backward compatible with Cat7, Cat6e, Cat6, Cat5e, Cat5
Test-NetConnection -ComputerName 203.0.113.20 -Port 21Use the real address for your service, not the documentation address above. If the hostname test fails but the verified address succeeds, investigate DNS records, split-horizon DNS, or an IPv4-versus-IPv6 path rather than a port-21 firewall rule.
Linux and macOS with netcat
- Open a terminal.
- Run:
nc -vz ftp.example.com 21 - Save the printed result and the address that was tried. Different netcat builds phrase success and failure differently, but a successful connection is normally reported explicitly.
The -v option requests a diagnostic message and -z asks netcat to probe without sending application data. If your system has both IPv6 and IPv4 records, run the test against each verified address separately. A result that differs by address is evidence of a path or listener difference, not proof that the FTP credentials are wrong.
Resolve the name before interpreting the port result
First establish what address the client is actually using. On Windows, Resolve-DnsName ftp.example.com displays DNS answers. On Linux or macOS, dig ftp.example.com (or dig A ftp.example.com and dig AAAA ftp.example.com) shows the records returned by the resolver.
Check all of the following:
- The hostname resolves at all; a name-resolution error is not a blocked TCP port.
- The returned address is the intended public or private address for this client’s network.
- An
A(IPv4) and anAAAA(IPv6) record do not point to different services. - A private address is not being advertised to clients outside the private network, or vice versa.
Repeat the port test by address when possible. Record the address, address family, interface, and result together; otherwise an apparently inconsistent test may simply be choosing a different DNS answer.
Recommended Free Tools
Interpret success, refusal, and timeout correctly
| Observed result | What it establishes | What it does not establish | Next check |
|---|---|---|---|
| TCP test succeeds | A TCP handshake to port 21 completed from this client and address. | It does not prove authentication, passive data connectivity, or a successful transfer. | Use a verbose FTP client, then test the passive data port. |
| Connection refused | The destination or an intermediate device actively rejected the connection. | It does not distinguish an absent listener from an intentionally rejecting firewall. | Verify the daemon is listening and inspect host and perimeter firewall rules. |
| Connection timed out | No completing handshake was observed before the probe gave up. | It does not identify the blocking device; filtering, routing failure, and an unreachable or powered-off service can look the same. | Compare another network and address family, then check server, security-group, NAT, and firewall logs. |
| Name cannot be resolved | The client did not obtain a usable address for the hostname. | It says nothing about whether TCP/21 is open at an address you have not reached. | Correct DNS or test a verified address directly. |
| Intermittent results | Reachability differs by time, resolver answer, route, or policy. | It is not evidence of a bad password. | Log timestamps, resolved addresses, networks, and IPv4/IPv6 results; correlate them with firewall logs. |
A refusal can occur when the host is reachable but no process is listening on port 21, or when a firewall is configured to reject rather than silently drop. A timeout is compatible with filtering, routing trouble, a powered-off host, or an unreachable service. The probe alone cannot localize the cause.
Rank #2
- Cat 6 performance at a Cat5e price but with higher bandwidth
- High Performance Cat6, 30 AWG, RJ45 Ethernet Patch Cable provides universal connectivity for LAN network components such as PCs,computer servers,printers,routers,switch boxes,network media players,NAS,VoIP phones
- Jadaol cat6 standard cable support Cat8 and Cat7 network and provides performance of up to 250 MHz 10Gbps and is suitable for 10BASE-T, 100BASE-TX (Fast Ethernet), 1000BASE-T/1000BASE-TX (Gigabit Ethernet) and 10GBASE-T (10-Gigabit Ethernet)
- UTP(Unshielded Twisted Pair) patch cable with RJ45 gold-plated Connectors and are made of 100% bare copper wire, ensure minimal noise and interference
- The unique flat cable shape allows for a cleaner and safer installation. You can easily and seamlessly make the cable run along walls, follow edges & corners or even make it completely invisible by sliding it under a carpet.
Confirm the control channel with an FTP client
After a successful TCP probe, connect with an FTP client that has verbose or debug logging enabled. The exact menu name varies, but look for a setting such as verbose logging, debug log, or show raw FTP commands.
- Connect to the same hostname and port 21 used in the probe.
- Confirm that the client receives an FTP banner. A banner demonstrates that an FTP service, rather than merely an open TCP socket, is responding.
- Attempt authentication and record the server’s response. A rejected password is an application-level result, not evidence that port 21 is blocked.
- Note whether the client is using passive mode. Keep that setting recorded for the data-channel test; active and passive operation take different network paths.
A banner and successful login demonstrate control-channel operation only. Microsoft’s IIS documentation describes FTP as requiring two maintained connections and warns that opening port 21 alone can allow commands while still preventing transfers.
Test the passive data connection
Find the port the server selected
In passive mode, the client sends PASV or EPSV. The server replies with an address and a port from its configured passive range. The client then opens a new TCP connection to that endpoint. A listing, upload, or download will wait if that port is blocked, the server advertises an unreachable address, or a NAT rule does not forward the range.
Enable raw-command logging and start a directory listing. Locate the passive reply in the log and record:
- the advertised address, if the reply includes one;
- the selected TCP port;
- whether the client attempted that address and port;
- the resulting timeout, refusal, or successful data connection.
The selected port may be valid only for that session. Treat it as a diagnostic observation, not a permanent port to add to a firewall rule.
Probe one configured passive port
If you administer the server, obtain its configured passive range and choose a port within that range. Test it from the same client network while the FTP service is ready to accept a passive connection:
Rank #3
- Designed for Outdoor & Direct Burial Installations – Heavy-duty double-shielded Cat8 Ethernet cable minimizes EMI/RFI interference and delivers stable long-distance performance. Waterproof, anti-corrosion PVC jacket allows safe direct burial and reliable use in outdoor or indoor environments.
- 26AWG for Stable High-Load Networks – Thicker 26AWG conductors provide faster, more stable data transmission than standard 32AWG cables. Ideal for high-performance home networks, gaming setups, smart homes, and data-intensive applications.
- F/FTP Shielding & Hyper-Speed Performance: Cat8 Ethernet cable constructed with 4 shielded foiled twisted pairs and 26AWG OFC conductors; supports bandwidth up to 2000 MHz and data transmission speeds up to 40 Gbps, effectively reducing signal interference and ensuring stable connections. Ideal for low-latency gaming, 4K/8K streaming, and high-speed internet connections.
- RJ45 Connectors & Wide Compatibility: Cat8 Ethernet cable with two shielded RJ45 connectors; compatible with networking switches, IP cameras, routers, Nintendo Switch, modems, PS3, PS4, Xbox, patch panels, servers, smart TVs, and more; works with Cat7, Cat6, Cat5e, and Cat5 devices
- Weatherproof & UV Resistant: Outdoor-rated Cat8 Ethernet cable with UV-resistant PVC jacket; withstands direct sunlight, extreme cold, humidity, and hot weather; anti-aging and durable; Includes 18-month support.
Test-NetConnection -ComputerName ftp.example.com -Port 50000On Linux or macOS:
nc -vz ftp.example.com 50000Replace 50000 with a port actually included in the server’s passive range. A successful TCP probe to one range member shows that the path can reach that port; it does not validate every port, the FTP protocol exchange, or the server’s advertised address. A failed probe is a strong reason to inspect the passive-range rules, but still must be compared with server and firewall logs.
Check the advertised address and NAT
A server behind NAT can accept port 21 correctly while returning a private address in its passive reply. The client then tries to connect to an address it cannot route to. Compare the address in the PASV/EPSV response with the address that should be reachable from the client’s network.
For a public service, verify that:
- the edge device forwards TCP/21 to the FTP host;
- the entire configured passive range is forwarded to that host;
- host and perimeter firewalls allow the range in the required direction;
- the server advertises the correct external address when clients connect through NAT;
- cloud security-group or network ACL rules match both the control port and passive range.
Do not open an arbitrary large port range merely because a listing failed. Use the server’s documented passive configuration, restrict it to the required range, and verify each rule in the relevant firewall logs.
Check the FTP server and its firewalls
Verify that a listener exists
On the server, confirm that the FTP daemon is bound to the expected interface and TCP port 21. A listener bound only to a loopback or private interface will not accept connections arriving on another address.
On Windows, an administrator can inspect listeners with:
Rank #4
- Cat 8 Speed, Cat 5/5e Value Enjoy Cat 8 Ethernet cable performance at a Cat 5/5e-level value. With up to 40Gbps speed and 2000MHz bandwidth, this high speed internet cable delivers more bandwidth than standard Cat 5 and Cat 5e cables, helping support smooth gaming, streaming, video calls, large file transfers and everyday wired network use.
- 40Gbps Speed, Wide Compatibility This Cat 8 Ethernet cable supports up to 40Gbps data transfer and 2000MHz bandwidth for fast, reliable internet performance. Standard RJ45 connectors are backward compatible with Cat7, Cat6, Cat6a and Cat5e devices, including routers, modems, switches, gaming PCs, PS5, PS4, Xbox, smart TVs, laptops and printers.
- Stable U/FTP Shielding Each of the 4 twisted pairs is individually wrapped with aluminum foil to help reduce crosstalk, noise, and signal interference. Combined with RJ45 connectors on both ends, the U/FTP design helps maintain cleaner signal transmission for a stable and reliable wired network connection.
- Nylon Braided Durability The nylon braided jacket adds everyday durability while keeping the cable flexible and easy to route. Reinforced construction helps the cord handle bending, pulling and frequent plugging, making it a reliable choice for desks, gaming rooms, home offices and long-term network setups.
- 50ft Reach for More Setups The 50 ft length makes it easier to connect devices across rooms, along walls, under desks or around corners. Great for router-to-PC connections, modem-to-TV setups, gaming consoles, workstations, printers and other home network equipment that needs a longer Ethernet cable.
netstat -ano | findstr :21On Linux, a typical check is:
ss -ltnp | grep ':21'These commands show local socket state; they do not replace an external test. A local listener can coexist with an upstream firewall that drops every Internet connection.
Review host-firewall rules
For IIS, Microsoft provides an inbound TCP rule example for local port 21 and separately explains that data-channel handling is required. Confirm that the rule applies to the active network profile and the intended interface. Then inspect rules for the configured passive range; permitting port 21 alone is insufficient for listings and transfers.
On any platform, look for recent denied or rejected events at the time of your test. Match the client’s source address, destination address, destination port, and timestamp. A log entry showing the packet never reached the host shifts attention to the edge firewall, cloud security group, NAT, or routing path.
Inspect cloud, edge, and forwarding policy
- Cloud security groups and network ACLs: check inbound TCP/21 and every passive-range rule, including source restrictions.
- Perimeter firewalls: distinguish a reject action from a silent drop and check whether outbound FTP is filtered for the client network.
- NAT and port forwarding: map TCP/21 and the passive range to the correct internal host.
- Routing: verify that replies return through a path that permits the client’s source address.
- Logs: correlate edge, host, and FTP-service timestamps rather than relying on a single probe result.
Compare networks, addresses, and FTP modes
Run the same command from the same type of client on a second network, such as a mobile hotspot or a different ISP. Keep the hostname, port, mode, and time recorded so that only the vantage point changes.
| Comparison | Pattern | Most likely area to investigate |
|---|---|---|
| Office network versus hotspot | Works on hotspot, fails at the office | Office egress policy, proxy, perimeter firewall, or ISP filtering on the office path. |
| Two unrelated networks | Fails everywhere | Server listener, host firewall, cloud security group, NAT/forwarding, or perimeter policy at the destination. |
| IPv4 versus IPv6 | One address family works and the other fails | Family-specific DNS, route, listener binding, firewall, or advertised passive address. |
| Control versus data | Banner and login work, listing or transfer fails | Passive range, NAT, advertised address, or data-channel firewall rules. |
| Hostname versus verified IP | IP works, hostname fails | DNS answer, split DNS, stale record, or a different IPv4/IPv6 destination. |
This comparison narrows the fault domain; it does not by itself prove which device blocked a packet. Confirm the hypothesis with the corresponding server, firewall, or security-group logs.
Best Value
- [Flat Design, Zero Cable Clutter] - Lies perfectly flat against walls, under rugs, along baseboards, and through tight spaces without kinks, tangles, or messy coils. Customers praise it for effortless installation and clean cable management that blends into any room.
- [REINFORCED BRAIDED CONSTRUCTION FOR LONG‑LASTING PERFORMANCE] - Premium cotton braided jacket paired with reinforced RJ45 connectors delivers outstanding durability, rigorously tested for over 15,000 bend cycles. Many customers describe this ethernet cable as rock‑solid and well‑crafted, ideal for long‑term daily use with no worries about premature wear‑and‑tear or connection failure
- [10GBPS SPEED & 600MHZ BANDWIDTH — GAMING, STREAMING & FIBER READY] - Delivers 10Gbps data transfer rate with 600MHz bandwidth for PS5, Xbox, 4K streaming, and fiber internet. Customers report stable performance and fast speeds. Backward compatible with Cat 6 and Cat 5e devices
- [STP SHIELDING & GOLD-PLATED RJ45 — MINIMIZES EMI/RFI INTERFERENCE] - 100% bare copper STP shielding helps protect signal integrity when routed near power cords. Gold-plated RJ45 connectors resist corrosion. Compatible with 2.5GB network card
- [Works with Everything — Router, Modem, PS5, Xbox, PC, Smart TV, Printer More ] - Full backward compatibility with Cat7, Cat6, Cat6a, and Cat5e devices means this one cable works with all your home or office equipment today, and future upgrades tomorrow. Works with 10/100/1000/10G/40G BASE-T speeds. Includes 36-month warranty with free replacement support
Common symptoms and the shortest diagnostic path
“The client cannot connect at all”
Resolve the hostname, then run the TCP/21 probe from the affected network. A name-resolution failure belongs to DNS. A refusal requires a listener and reject-policy check. A timeout requires a second-network comparison and inspection of routing, filtering, NAT, and server availability.
“Login works, but the directory listing hangs”
Stop changing the password. The control channel is already working. Turn on verbose logging, identify the passive reply and selected port, and test that port from the same client network. Check the passive range, advertised address, NAT forwarding, and firewall rules on both the server and the network edge.
“It works from home but not from the company network”
Run the same hostname and port-21 test on both networks and compare the resolved address and address family. If only the company path fails, ask the network administrator to check outbound TCP policy and logs. Do not conclude that the FTP server is down while another network can complete the control handshake.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall“The hostname fails, but an IP address succeeds”
Compare A and AAAA records, cached answers, and the address shown by the test tool. Correct the record or client DNS path before changing FTP or firewall settings. If the FTP server is behind NAT, also verify that the address clients receive is the externally reachable one.
A reusable evidence checklist
Collect these details for each attempt:
- date and time, including time zone;
- client network and public source address, if available;
- hostname and every resolved address tested;
- IPv4 or IPv6 path and client interface;
- TCP/21 command and complete result, including
TcpTestSucceededon Windows; - FTP banner and authentication response from the verbose client log;
- passive-mode command, advertised address, selected data port, and data-connection result;
- server listener state and relevant host, cloud, NAT, edge-firewall, and FTP-service log entries.
This record separates a blocked control port from a DNS error, an address-family mismatch, a rejected connection, a silent drop, and a data-channel configuration failure. It also gives an administrator enough context to reproduce the problem instead of guessing from a single “FTP failed” message.
What a complete diagnosis looks like
You can call port 21 reachable when a TCP probe from the affected client network completes to the intended server address and the FTP client receives a banner. You can call the control service usable when authentication also succeeds. You can call ordinary FTP operation usable only after a passive data connection completes for a listing or transfer.
If the first condition fails, work through DNS, address selection, route, listener, host firewall, cloud policy, NAT, and perimeter logs. If the first two succeed but the third fails, leave port 21 alone and focus on the server-selected passive port, advertised address, forwarding, and data-channel rules. That distinction prevents the common mistake of repeatedly opening or testing port 21 when the blocked connection is elsewhere.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
