Directory listing problems

Login and listing are different steps

FTP keeps commands on a control connection and moves the listing, or a file, on a data connection. FileZilla can show 230 Login successful and then “Failed to retrieve directory listing.” The account is fine. The second socket is not.

Passive mode is the usual choice. The client sends PASV or EPSV, the server answers with an address and a port, and the client connects outward to that port. Active mode reverses this: the server connects back to you. On a home router, that return path is the one that usually fails, so leave the transfer mode on Passive unless you are doing a controlled test. FileZilla’s own network configuration notes are in the project’s network configuration guide.

Read the 227 line

A passive reply names the endpoint in six numbers. The first four are the address. The last two encode the port: multiply the fifth by 256 and add the sixth.

Example only. 203.0.113.10 is a documentation address.

If the address is private — 10.x, 192.168.x, or 172.16 through 172.31 — and you are connecting across the internet, the server told you to open a data socket on an address that exists only on its local network. The listing then times out. The lasting repair is on the server: it must advertise the public address clients can reach. In FileZilla, Edit → Settings → Connection → FTP → Passive mode includes “Use the server’s external IP address instead.” That tells the client to use the address of the control connection. It is a workaround for a misadvertised PASV address, and it does not disable TLS.

The passive port has to be reachable

Even with the right public address, the calculated port has to accept your connection. Operators publish a passive range and forward that range to the FTP service. If the range is closed, the control connection and the 230 stay healthy, and MLSD or LIST sits until the data connection times out.

Response: 230 Login successful
Command: PASV
Response: 227 Entering Passive Mode (203,0,113,10,195,149)
Command: MLSD
Error: Connection timed out after 20 seconds of inactivity
Error: Failed to retrieve directory listing

Take the calculated port to the operator. Asking them to “check FTP” without the port number usually produces a test from inside their own network, which succeeds while your external session still fails. FileZilla cannot choose the server’s passive port. Allowing outbound connections from your computer matters too: a local firewall that permits port 21 and blocks everything else will log in and then fail the list.

When someone suggests active mode

Active mode can succeed on a network where you control the return path and have forwarded a high port range to your computer. It is a poor default. The server must connect inbound to you, and encrypted FTP prevents many routers from rewriting that command for you. If you test it, change one site, not the global setting for every server, and switch the site back to Passive when the test is over. Edit → Settings → Connection → FTP can allow a fallback to the other transfer mode. Fallback hides which mode actually worked, so turn it off while you are diagnosing.

FTPS adds a check on that second connection

Explicit FTPS protects both connections. Some servers require the data connection to resume the same TLS session. When that fails, the reply is a 425 about the TLS session of the data connection not being resumed. The usual causes are a passive range that is not forwarded one-to-one, or a firewall or security product that intercepts TLS and breaks the resume.

Compare the certificate fingerprint with the value published by the operator. An intercepted connection can present a different certificate than the server’s. The repair is to stop the interception or to fix the server’s passive forwarding.

550 is a path, not a firewall

A 550 on CWD, MLSD, or LIST means the server refused the directory operation. The folder may not exist, the account may not be allowed to read it, or the default remote directory in Site Manager may point at the wrong place. A common case is a login that already lands in public_html while the site also sets the remote directory to /public_html, so the client asks for a nested folder that is not there.

Clear Default remote directory under the Advanced tab and connect again. If the home directory then lists, the path was the fault. If the home directory itself returns 550, the operator has to repair the account’s home or its permissions. Client-side passive settings will not create a folder you are not allowed to see.

SFTP does not use PASV

An SFTP listing travels on the SSH session you already authenticated. There is no 227 line and no separate listing port. Passive and active FTP settings do not apply. If the list fails, clear the default remote directory so you arrive in the account’s home, and read any permission or “no such file” text beside the path. A disconnect that mentions a forced command or an SFTP subsystem is server-side SSH configuration.

An empty pane is not always a failure

If the log says the directory listing succeeded and the remote pane is empty, the folder is empty or a filename filter is hiding files. That is not “Failed to retrieve directory listing.” Garbled names, with the list itself present, are a charset mismatch on the Charset tab, not a closed data port. Leave the charset on automatic unless the operator named an encoding.

A practical sequence

1. Confirm 230 or a finished SSH login before you touch the password again.
2. For FTP or FTPS, find PASV and the 227 reply. Calculate the port and note whether the address is private.
3. Keep this site on passive mode while you test. Change fallback off so the log shows the mode you intend.
4. If the address is private, ask the operator to advertise the public address. The external-IP workaround is only a bridge.
5. If the address is public and the data connection times out, ask them to open that passive port to the internet.
6. If the code is 550, fix the remote directory before you change firewall rules.
7. For a TLS resume error, verify the certificate fingerprint and the one-to-one passive forwarding. Leave encryption required.

How to tell it is fixed

The listing is fixed when the log records a successful directory listing and the remote pane shows the folder you expect, including the case where that folder is honestly empty. A transfer of a small known file is the follow-up check. If the list works and the file fails with the same 425 or timeout, the data connection is still unreliable and the listing only looked healthy because it was small.

Common mistakes

• Editing the password after 230 Login successful.
• Switching to active mode on a home network and calling the server broken.
• Ignoring a private address inside the 227 reply.
• Disabling TLS because the data connection failed the session resume check.
• Applying FTP passive advice to an SFTP session that never sends PASV.