You're both right-- port 21 is to establish the connection, port 20 is for the ftp data.

Here're some links:
http://www.iana.org/assignments/port-numbers
http://www.networkice.com/advice/Exploits/Ports/

------------------
Am386DX-40 + Cx387DX-40
32MB, 128KB cache
(2)Seagate 540MB HD's
8x CD
2MB Trident
SB16 PnP
DR-DOS 7.04
Windows 3.11 (w/ Win32s)
--
Just because you can't solve it doesn't make it a virus!