The WCCP ftp-native service in ACNS redirects TCP traffic destined to ports 21 and 40020. Intercepting port 21 gives us the FTP control connection. In the event that the client requests passive mode, ACNS tells the client (over the control connection) to establish a connection on tcp/40020. Since this port is already defined as part of the ftp-native WCCP service, this gives us the data connection as well.
If you're interested in checking what protocol/port(s) are defined as part of a WCCP service group, you can use the commands:
show wccp services detail - Command on ACNS and WAAS devices
show ip wccp service - Hidden IOS command, where is the numeric service ID for the service
If you have any additional questions, please let us know.
Regards,
Zach