The attacker can also thread a connection through many FTP servers, even if none of them have any special authorization, so that he becomes extremely difficult to track down. Many servers deliberately disobey this requirement, and make connections from high port numbers instead. All servers should reject PORT requests that show IP addresses other than the client's address. All servers should also reject PORT requests that show port numbers below 1024. These rules eliminate most, though not all, of the dangerous connection possibilities.
Similar comments apply to clients talking to untrustworthy servers.
Then PASV was added to support a minor efficiency hack known as third-party FTP or proxy FTP . The client could arrange for one FTP server to transfer files directly to another FTP server, without the client in the middle, by sending PORT to the first server and PASV to the second. Of course, from the first server's point of view, proxy FTP is connection laundering. From the second server's point of view, proxy FTP is a file replacement attack. In early 1995, security-aware servers started to disable connection laundering, restricting PORT to the client's address.