TFTP Read Request and File Transfer Packet Capture

Lesson Contents

This packet capture contains a complete TFTP (Trivial File Transfer Protocol) download. Router R1 requests the file R2.cfg from 192.168.12.2. The file arrives in four data blocks, and R1 acknowledges each one before the next is sent. Nine packets for a 1,673-byte file.

TFTP has no login, no directory listing and no encryption. Everything, including the file contents, is in clear text. The capture also shows a detail that trips up firewalls: the server doesn’t answer from port 69. More captures are in the Packet Capture Library.

Want to open this capture in Wireshark yourself? The pcap file is free with a NetworkLessons account. Your free account also unlocks all our free lessons and every capture in the Packet Capture Library.

Create a free account to download the pcap

Already have an account? Log in and the download button appears here.

Capture overview

File	tftp-read-request-file-transfer.pcapng
Packets	9
Protocol	TFTP (RFC 1350)
Transport	UDP: request to port 69, transfer between ports 55180 and 60301
Devices	Cisco IOS routers: client 192.168.12.1, server 192.168.12.2
Wireshark filter	`tftp`

Packets in this capture

No.  Time      Source        Destination   Protocol  Info
1    0.000000  192.168.12.1  192.168.12.2  TFTP      Read Request, File: R2.cfg, Transfer type: octet
2    0.000989  192.168.12.2  192.168.12.1  TFTP      Data Packet, Block: 1
3    0.001325  192.168.12.1  192.168.12.2  TFTP      Acknowledgement, Block: 1
4    0.001930  192.168.12.2  192.168.12.1  TFTP      Data Packet, Block: 2
5    0.002184  192.168.12.1  192.168.12.2  TFTP      Acknowledgement, Block: 2
6    0.002363  192.168.12.2  192.168.12.1  TFTP      Data Packet, Block: 3
7    0.002696  192.168.12.1  192.168.12.2  TFTP      Acknowledgement, Block: 3
8    0.002951  192.168.12.2  192.168.12.1  TFTP      Data Packet, Block: 4 (last)
9    0.003089  192.168.12.1  192.168.12.2  TFTP      Acknowledgement, Block: 4

Packet walkthrough

Read request (packet 1)

User Datagram Protocol, Src Port: 55180, Dst Port: 69
Trivial File Transfer Protocol
    Opcode: Read Request (1)
    Source File: R2.cfg
    Type: octet

This is what the fields in red mean:

UDP destination port 69: only the first packet goes to the well-known TFTP port.
Opcode 1: Read Request (RRQ): download a file. A write request (upload) is opcode 2.
Filename R2.cfg: TFTP only has a filename, no paths beyond what the server allows and no username or password.
Mode octet: binary transfer, byte for byte. The other mode, netascii, converts line endings.

Data and acknowledgment (packets 2 and 3)

User Datagram Protocol, Src Port: 60301, Dst Port: 55180
Trivial File Transfer Protocol
    Opcode: Data Packet (3)
    Block: 1

Here’s what stands out:

Source port 60301, not 69: the server answers from a new random port, the transfer ID. The rest of the transfer runs between ports 55180 and 60301. A firewall that only allows UDP 69 blocks the data.
Opcode 3: Data, block 1: each data packet carries a block number and up to 512 bytes of the file. The UDP length is 524: 8 bytes of UDP header, 4 bytes of TFTP header and 512 bytes of data.
Opcode 4: Acknowledgment, block 1 (packet 3): R1 confirms block 1, and only then does the server send block 2. This lock-step exchange is simple but slow over long distances.
The data is readable: open the data packets in Wireshark and you see the router configuration in clear text.

The last block (packets 8 and 9)

Block 4 is only 137 bytes (UDP length 149). A data block shorter than 512 bytes tells the client this is the end of the file: 3 × 512 + 137 = 1,673 bytes. R1 acknowledges block 4, and the transfer is done. There’s no separate “end” message.