til

TIL: TFTP

Roland Szabo

Roland Szabo

— 1 min read
Share

TFTP is Trivial File Transfer Protocol. I learned about it today because I used it to flash OpenWRT on my ancient Travel Router.

Basically you launch a "server" from a folder and then the client connects to it and can request files. There's no directory browsing, no encryption. The router knew that it had to ask for two files named in a specific way and that's it.

Of course, the IP it's looking at is also hardcoded (in my case at 10.10.10.254), so I had to change my laptop's IP address temporarily to that.

Seeing what's going on is super simple:

sudo tcpdump -ni en8 'arp or port 69'
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on en8, link-type EN10MB (Ethernet), snapshot length 524288 bytes
14:35:30.525911 ARP, Probe 169.254.57.251, length 28
14:35:30.850445 ARP, Probe 169.254.57.251, length 28
14:35:31.174733 ARP, Probe 169.254.57.251, length 28
14:35:31.495124 ARP, Announcement 169.254.57.251, length 28
14:38:11.701282 ARP, Request who-has 10.10.10.254 tell 10.10.10.128, length 46
14:38:11.701360 ARP, Reply 10.10.10.254 is-at a0:ce:c8:e6:c0:97, length 28
14:38:11.712067 IP 10.10.10.128.2258 > 10.10.10.254.69: TFTP, length 25, RRQ "kernel" octet timeout 5
14:38:12.622763 ARP, Request who-has 10.10.10.254 tell 10.10.10.128, length 46
14:38:12.622801 ARP, Reply 10.10.10.254 is-at a0:ce:c8:e6:c0:97, length 28
4:38:12.633537 IP 10.10.10.128.1802 > 10.10.10.254.69: TFTP, length 25, RRQ "rootfs" octet timeout 5

Those lines with "kernel" and "rootfs" are where the router was requesting the files.

Don't ask why I needed this. But thanks ChatGPT.

Read more