3

A teacher of mine says when you are browsing a web server such as apache2 that has file/directory listing enabled then it secretly opens an ftp server to transfer the file.

This confuses me, though he does know more than me when it comes to networking, as he could not explain it to me so that I'd understand.

If I don't have an ftp server or that port running, then how does it get sent by that service? Does apache2 have ftp built in that I don't know about? If a file is requested by an apache2 directory listing then is it being sent over HTTP or FTP?

eric
  • 41
  • 3
  • 1
    FYI - this was voted-closed as being offtopic for professional sysadmin work, because it is. But I felt it worth answering anyway. If you'd like to continue participating on this site (which I encourage), read through the Help content (link at top of every page) and participate in Chat, and SuperUser might be a good community for you as well. – mfinni Dec 26 '13 at 17:30
  • @mfinni Ok. I was having a hard time deciding which Q/A site to use actually. Thanks for the suggestion. – eric Dec 27 '13 at 13:14

1 Answers1

16

Ugh. Your teacher is not correct at all. HTTP transfers files - that's how it works. It doesn't require anything special to do so, even if an Apache directory listing kinda looks like an FTP server listing.

Look at your browser URL. Use a tool like Wireshark or Fiddler to actually look at the traffic. You'll see that if you're browsing via HTTP, and the links to files begin with HTTP, then your download will be over HTTP.

If you can do this on your own with one of these tools, bring it up to your teacher that you'd like to go over this with him after class. Procure a Windows laptop, bring Fiddler on a USB stick. Do this exercise together. If the teacher is misinformed and giving false info to students, you're helping him.

mfinni
  • 36,144
  • 4
  • 53
  • 86
  • Thanks for clearing that up. I was thinking there was something big I might have been missing? But I knew if it had http:// then it must be http. – eric Dec 26 '13 at 15:20
  • 6
    +1. Always nice to see so incompetent teachers telling utter crap to students. A file / directory listing is just another html document that the apache just automatically generates (because it has been told to in the config). – TomTom Dec 26 '13 at 15:20
  • Unfortunately arguing with the teacher makes me look like a major douchenozzle. Especially when we have limited time in class. – eric Dec 26 '13 at 15:23
  • 4
    This would imply every webserver also runs an FTP server. It's quite easy to show that this isn't the case for the majority of websites. – Teun Vink Dec 26 '13 at 15:34
  • HTTP Tutorial easy read: http://www.garshol.priv.no/download/text/http-tut.html – TheCleaner Dec 26 '13 at 15:36
  • 7
    Just send your teacher a link to this page and then hide under a desk. – Skyhawk Dec 26 '13 at 15:38
  • Yes. This is the best - tell him you needed more explanations and asked (with this link), then the "wannabe export" can read here that he should better get a job at McDonalds - or learn up on the topics he is teaching people. – TomTom Dec 26 '13 at 15:57
  • 3
    Older browsers such as Navigator and older versions of IE were capable of browsing FTP servers; their directory structure would be represented by a client side-generated HTML page of files and folders similar to what an Apache directory listing looks like. Perhaps this is what's confusing your teacher. As browsing FTP servers has become a less common activity for most users, I believe all major browsers nowadays have removed this functionality to reduce their attack surface. – Garrett Albright Dec 26 '13 at 16:31
  • 1
    @GarrettAlbright: Both Chrome and Firefox (on MacOS and Linux) still do this, but Safari delegates this to the default FTP client. – Sven Dec 26 '13 at 16:39
  • SvW: I see. Thanks for the clarification. It's probably easy to guess which of those browsers I'm using the most nowadays… – Garrett Albright Dec 26 '13 at 16:52