Tftp error codes

Not defined, File not found, Access violation, Disk full or allocation exceeded, Unknown transfer ID, Unknown transfer ID, File already exists, No such user, Terminate transfer due to option negotiation

In this article, we will focus on how to troubleshoot the common Trivial File Transfer Protocol (TFTP) issues with Wireshark between server and client.

What is TFTP?

TFTP is a file transfer protocol that enables a client to upload a file to a server or download a file from the server. The protocol is simple and designed to be implemented in ROM for booting diskless systems like X terminals, diskless workstations, and routers. It was planned to be small and easy to implement.  Therefore, it lacks most of the features of a regular FTP.  The protocol is only capable of reading and writing files (or mail) from/to a remote server.  It cannot list directories, and currently has no provisions for user authentication.

ALSO READ: Create Wireshark Configuration Profiles [Step-by-Step]

TFTP Packet Types

TFTP packets are transferred over User Datagram Protocol (UDP), which is an unreliable transport protocol. In other words, UDP provides no recovery for lost packets. To fix this problem, TFTP uses a mechanism like TCP ACK and provides reliability in application layer. Any transfer begins with a request to read or write a file and then the data packets are sent in fixed length, which is called a block. Each data packet contains only one block of data, and is acknowledged by an acknowledgment packet before the next packet can be sent.

TFTP supports 6 packet types:

How to troubleshoot TFTP Issues with Wireshark

Following steps show a typical file transfer and packet types used between the client and server.

Packet flow of File Transfer between TFTP Server and Client

Step-1:  The client sends a read request for “startup-config” file and asks server to use block size of 128 bytes.

How to troubleshoot TFTP Issues with Wireshark

Step-2:  The server replies with an Option ACK packet, which includes the block size accepted by the server and the size of the file to be transferred.

How to troubleshoot TFTP Issues with Wireshark

Step-3:  After acknowledging the options, the server sends the first block (packet) of the data.

How to troubleshoot TFTP Issues with Wireshark

Step-4: The client acknowledges the first block of the data and the file transfer follows the same pattern (sending data and expecting an ack) until it is transferred completely.

ALSO READ: Detect Rogue DHCP Server with Wireshark [Step-by-Step]

How to troubleshoot TFTP Issues with Wireshark

Troubleshooting TFTP Errors

During a file transfer, errors may occur and RFC 1350 defines 8 error codes for identifying the problems. The codes and their brief explanations are below.

How to troubleshoot TFTP Issues with Wireshark

TFTP errors are caused by three types of events:

  1. Not being able to satisfy the request (e.g., file not found, access violation, or no such user).
  2. Receiving a packet which cannot be explained by a delay or duplication in the network (e.g., an incorrectly formed packet).
  3. Losing access to a necessary resource (e.g., disk full or access denied during a transfer).

TFTP issues can be categorized into 2 groups:

  • Client or server related issues
  • Network related issues

We will mainly focus on the first category. TFTP peers use Opcode 5 to inform each other when they come across an error. Each error packet has an error code and error message. Following figure shows a typical error packet format.

Understanding different TFTP Error Codes

We will produce the TFTP errors and analyze them with Wireshark.

Error Code 0 (Not defined, see error message (if any))

This is a general error code. When the client or server can’t identify the error, it replies with this error code and includes more details in the error message. Following screenshot shows the error.

ALSO READ: Easy steps to open a port in Linux RHEL/CentOS 7/8

How to troubleshoot TFTP Issues with Wireshark

To produce this error, I dropped TFTP packets on the firewall purposely. The client (192.168.1.50) requested for “test.txt” file and did not receive any response from the server. Since the packet filtering on the network was the cause of the problem, the client could not categorize the error and sent this general error. Even though there is no error code in the RFC to define this problem, the client puts some reasonable information in the “Error message”, which is “timeout on receive” in this case. Unfortunately, not all TFTP clients send this error, which makes it hard to resolve the problems.

Error Code 1 (File not found)

The client receives this error code when the requested file does not exist. As seen below, the error message is also enough to define the problem. This is clearly not a network related problem. When getting this error, we should check the file path and name of the file to see if it is correct or not.

How to troubleshoot TFTP Issues with Wireshark

Error Code 2 (Access violation)

This error is seen when we ask for a file on which we do not have the right to read or write. I produced this error with trying to transfer (write) a file to the server while I did not have that right (writing). A TFTP server can let you change security settings like reading, writing or both of them.

ALSO READ: How to setup and test AAA with NPS Server (Part 2)

How to troubleshoot TFTP Issues with Wireshark

Error Code 3 (Disk full or allocation exceeded)

TFTP client receives this error when there is limited storage area on the server. I produced this error with limiting the quota for the folder and then transferring a larger file than the reserved quota.

How to troubleshoot TFTP Issues with Wireshark

Error Code 4 (Unknown transfer ID)

Any TFTP packet does not follow the RFC is called illegal. A packet with an unknown opcode, a packet with a malformed payload, or a packet that is out of sequence with the normal flow of commands/responses would all be considered «illegal». I produced this error with crafting a TFP data packet and sending it to the server without sending a read or write request in the beginning.

How to troubleshoot TFTP Issues with Wireshark

Error Code 5 (Unknown transfer ID)

When a TFTP client sends a duplicate read request (typically this happens when the first read request times out), the requests may create an unexpected situation on the server. The server thinks it received different requests from the client and responds accordingly. When the client notices the server interpreted the duplicate packets as different requests, it sends this error to the server, which does not cause a termination. After receiving this error, the server immediately stops the other transferring. I was not be able to produce this error code.

ALSO READ: Troubleshooting TLS Failures using Wireshark

Error Code 6 (File already exists)

This error is received when there is a file with the same name on the server. I produced this file with transferring the same file to the server.

How to troubleshoot TFTP Issues with Wireshark

Error Code 7 (No such user)

Once the protocol was first adopted, it supported three modes of transferring, which were netascii, octet and mail mode, which was used for sending files to an email address. This error is received when the recipient username does not exist on the server. This mode is not used anymore.

Error Code 8 (Terminate transfer due to option negotiation)

TFTP client and server negotiate options during a read or write request. When the negotiations fail, the peer sends this error code to terminate the transfer. I produced this error with sending some option that server did not support. As seen below, Wireshark is not able to decode this new error properly.

How to troubleshoot TFTP Issues with Wireshark

Network Related TFTP Issues

TFTP uses port 69 as its destination when making a read or write request.  After receiving the request, the server uses a random port for the transfer instead of answering from port 69.  Even if you allow port 69 on the firewall, the transfer may fail due to not inspecting TFTP as service (protocol). Most common network failures happen because of firewall policy. Following screenshot shows a typical file transfer in perspective of using ports.

ALSO READ: Decrypt RDP Traffic with Wireshark and Frida [Step-by-Step]

How to troubleshoot TFTP Issues with Wireshark

TFTP server and client generally use block size of 512 bytes on default. For faster transmission, we may need to set the size to a higher value, which may fail the transfer when the data packets size exceeds the path MTU size.

Packet loss in the network is another factor that can disrupt TFTP transfer.

Final Thoughts

It is easy to troubleshoot when the problem caused by either TFTP client or server. With using Wireshark’s “tftp.opcode == 5” display filter, we can list all TFTP errors and inspect them. Some network issues may not be identified by only using this filter. We need a network trace file from both of the side to have a better observation.

References

https://docstore.mik.ua/orelly/networking_2ndEd/fire/ch17_02.htm
https://datatracker.ietf.org/doc/html/rfc783

Related Keywords: Not defined, File not found, Access violation, Disk full or allocation exceeded, Unknown transfer ID, Unknown transfer ID, File already exists, No such user, Terminate transfer due to option negotiation, troubleshoot tftp errors with wireshark

[RFC Home] [TEXT|PDF|HTML] [Tracker] [IPR] [Errata] [Info page]

INTERNET STANDARD
Updated by: 1782, 1783, 1784, 1785, 2347, 2348, 2349 Errata Exist

Network Working Group                                         K. Sollins
Request For Comments: 1350                                           MIT
STD: 33                                                        July 1992
Obsoletes: RFC 783


                     THE TFTP PROTOCOL (REVISION 2)

Status of this Memo

   This RFC specifies an IAB standards track protocol for the Internet
   community, and requests discussion and suggestions for improvements.
   Please refer to the current edition of the "IAB Official Protocol
   Standards" for the standardization state and status of this protocol.
   Distribution of this memo is unlimited.

Summary

   TFTP is a very simple protocol used to transfer files.  It is from
   this that its name comes, Trivial File Transfer Protocol or TFTP.
   Each nonterminal packet is acknowledged separately.  This document
   describes the protocol and its types of packets.  The document also
   explains the reasons behind some of the design decisions.

Acknowlegements

   The protocol was originally designed by Noel Chiappa, and was
   redesigned by him, Bob Baldwin and Dave Clark, with comments from
   Steve Szymanski.  The current revision of the document includes
   modifications stemming from discussions with and suggestions from
   Larry Allen, Noel Chiappa, Dave Clark, Geoff Cooper, Mike Greenwald,
   Liza Martin, David Reed, Craig Milo Rogers (of USC-ISI), Kathy
   Yellick, and the author.  The acknowledgement and retransmission
   scheme was inspired by TCP, and the error mechanism was suggested by
   PARC's EFTP abort message.

   The May, 1992 revision to fix the "Sorcerer's Apprentice" protocol
   bug [4] and other minor document problems was done by Noel Chiappa.

   This research was supported by the Advanced Research Projects Agency
   of the Department of Defense and was monitored by the Office of Naval
   Research under contract number N00014-75-C-0661.

1. Purpose

   TFTP is a simple protocol to transfer files, and therefore was named
   the Trivial File Transfer Protocol or TFTP.  It has been implemented
   on top of the Internet User Datagram protocol (UDP or Datagram) [2]



Sollins                                                         [Page 1]


RFC 1350                    TFTP Revision 2                    July 1992


   so it may be used to move files between machines on different
   networks implementing UDP.  (This should not exclude the possibility
   of implementing TFTP on top of other datagram protocols.)  It is
   designed to be small and easy to implement.  Therefore, it lacks most
   of the features of a regular FTP.  The only thing it can do is read
   and write files (or mail) from/to a remote server.  It cannot list
   directories, and currently has no provisions for user authentication.
   In common with other Internet protocols, it passes 8 bit bytes of
   data.

   Three modes of transfer are currently supported: netascii (This is
   ascii as defined in "USA Standard Code for Information Interchange"
   [1] with the modifications specified in "Telnet Protocol
   Specification" [3].)  Note that it is 8 bit ascii.  The term
   "netascii" will be used throughout this document to mean this
   particular version of ascii.); octet (This replaces the "binary" mode
   of previous versions of this document.) raw 8 bit bytes; mail,
   netascii characters sent to a user rather than a file.  (The mail
   mode is obsolete and should not be implemented or used.)  Additional
   modes can be defined by pairs of cooperating hosts.

   Reference [4] (section 4.2) should be consulted for further valuable
   directives and suggestions on TFTP.

2. Overview of the Protocol

   Any transfer begins with a request to read or write a file, which
   also serves to request a connection.  If the server grants the
   request, the connection is opened and the file is sent in fixed
   length blocks of 512 bytes.  Each data packet contains one block of
   data, and must be acknowledged by an acknowledgment packet before the
   next packet can be sent.  A data packet of less than 512 bytes
   signals termination of a transfer.  If a packet gets lost in the
   network, the intended recipient will timeout and may retransmit his
   last packet (which may be data or an acknowledgment), thus causing
   the sender of the lost packet to retransmit that lost packet.  The
   sender has to keep just one packet on hand for retransmission, since
   the lock step acknowledgment guarantees that all older packets have
   been received.  Notice that both machines involved in a transfer are
   considered senders and receivers.  One sends data and receives
   acknowledgments, the other sends acknowledgments and receives data.

   Most errors cause termination of the connection.  An error is
   signalled by sending an error packet.  This packet is not
   acknowledged, and not retransmitted (i.e., a TFTP server or user may
   terminate after sending an error message), so the other end of the
   connection may not get it.  Therefore timeouts are used to detect
   such a termination when the error packet has been lost.  Errors are



Sollins                                                         [Page 2]


RFC 1350                    TFTP Revision 2                    July 1992


   caused by three types of events: not being able to satisfy the
   request (e.g., file not found, access violation, or no such user),
   receiving a packet which cannot be explained by a delay or
   duplication in the network (e.g., an incorrectly formed packet), and
   losing access to a necessary resource (e.g., disk full or access
   denied during a transfer).

   TFTP recognizes only one error condition that does not cause
   termination, the source port of a received packet being incorrect.
   In this case, an error packet is sent to the originating host.

   This protocol is very restrictive, in order to simplify
   implementation.  For example, the fixed length blocks make allocation
   straight forward, and the lock step acknowledgement provides flow
   control and eliminates the need to reorder incoming data packets.

3. Relation to other Protocols

   As mentioned TFTP is designed to be implemented on top of the
   Datagram protocol (UDP).  Since Datagram is implemented on the
   Internet protocol, packets will have an Internet header, a Datagram
   header, and a TFTP header.  Additionally, the packets may have a
   header (LNI, ARPA header, etc.)  to allow them through the local
   transport medium.  As shown in Figure 3-1, the order of the contents
   of a packet will be: local medium header, if used, Internet header,
   Datagram header, TFTP header, followed by the remainder of the TFTP
   packet.  (This may or may not be data depending on the type of packet
   as specified in the TFTP header.)  TFTP does not specify any of the
   values in the Internet header.  On the other hand, the source and
   destination port fields of the Datagram header (its format is given
   in the appendix) are used by TFTP and the length field reflects the
   size of the TFTP packet.  The transfer identifiers (TID's) used by
   TFTP are passed to the Datagram layer to be used as ports; therefore
   they must be between 0 and 65,535.  The initialization of TID's is
   discussed in the section on initial connection protocol.

   The  TFTP header consists of a 2 byte opcode field which indicates
   the packet's type (e.g., DATA, ERROR, etc.)  These opcodes and  the
   formats of  the various types of packets are discussed further in the
   section on TFTP packets.











Sollins                                                         [Page 3]


RFC 1350                    TFTP Revision 2                    July 1992


          ---------------------------------------------------
         |  Local Medium  |  Internet  |  Datagram  |  TFTP  |
          ---------------------------------------------------

                      Figure 3-1: Order of Headers


4. Initial Connection Protocol

   A transfer is established by sending a request (WRQ to write onto a
   foreign file system, or RRQ to read from it), and receiving a
   positive reply, an acknowledgment packet for write, or the first data
   packet for read.  In general an acknowledgment packet will contain
   the block number of the data packet being acknowledged.  Each data
   packet has associated with it a block number; block numbers are
   consecutive and begin with one.  Since the positive response to a
   write request is an acknowledgment packet, in this special case the
   block number will be zero.  (Normally, since an acknowledgment packet
   is acknowledging a data packet, the acknowledgment packet will
   contain the block number of the data packet being acknowledged.)  If
   the reply is an error packet, then the request has been denied.

   In order to create a connection, each end of the connection chooses a
   TID for itself, to be used for the duration of that connection.  The
   TID's chosen for a connection should be randomly chosen, so that the
   probability that the same number is chosen twice in immediate
   succession is very low.  Every packet has associated with it the two
   TID's of the ends of the connection, the source TID and the
   destination TID.  These TID's are handed to the supporting UDP (or
   other datagram protocol) as the source and destination ports.  A
   requesting host chooses its source TID as described above, and sends
   its initial request to the known TID 69 decimal (105 octal) on the
   serving host.  The response to the request, under normal operation,
   uses a TID chosen by the server as its source TID and the TID chosen
   for the previous message by the requestor as its destination TID.
   The two chosen TID's are then used for the remainder of the transfer.

   As an example, the following shows the steps used to establish a
   connection to write a file.  Note that WRQ, ACK, and DATA are the
   names of the write request, acknowledgment, and data types of packets
   respectively.  The appendix contains a similar example for reading a
   file.









Sollins                                                         [Page 4]


RFC 1350                    TFTP Revision 2                    July 1992


      1. Host A sends  a  "WRQ"  to  host  B  with  source=  A's  TID,
         destination= 69.

      2. Host  B  sends  a "ACK" (with block number= 0) to host A with
         source= B's TID, destination= A's TID.

   At this point the connection has been established and the first data
   packet can be sent by Host A with a sequence number of 1.  In the
   next step, and in all succeeding steps, the hosts should make sure
   that the source TID matches the value that was agreed on in steps 1
   and 2.  If a source TID does not match, the packet should be
   discarded as erroneously sent from somewhere else.  An error packet
   should be sent to the source of the incorrect packet, while not
   disturbing the transfer.  This can be done only if the TFTP in fact
   receives a packet with an incorrect TID.  If the supporting protocols
   do not allow it, this particular error condition will not arise.

   The following example demonstrates a correct operation of the
   protocol in which the above situation can occur.  Host A sends a
   request to host B. Somewhere in the network, the request packet is
   duplicated, and as a result two acknowledgments are returned to host
   A, with different TID's chosen on host B in response to the two
   requests.  When the first response arrives, host A continues the
   connection.  When the second response to the request arrives, it
   should be rejected, but there is no reason to terminate the first
   connection.  Therefore, if different TID's are chosen for the two
   connections on host B and host A checks the source TID's of the
   messages it receives, the first connection can be maintained while
   the second is rejected by returning an error packet.

5. TFTP Packets

   TFTP supports five types of packets, all of which have been mentioned
   above:

          opcode  operation
            1     Read request (RRQ)
            2     Write request (WRQ)
            3     Data (DATA)
            4     Acknowledgment (ACK)
            5     Error (ERROR)

   The TFTP header of a packet contains the  opcode  associated  with
   that packet.







Sollins                                                         [Page 5]


RFC 1350                    TFTP Revision 2                    July 1992


            2 bytes     string    1 byte     string   1 byte
            ------------------------------------------------
           | Opcode |  Filename  |   0  |    Mode    |   0  |
            ------------------------------------------------

                       Figure 5-1: RRQ/WRQ packet


   RRQ and WRQ packets (opcodes 1 and 2 respectively) have the format
   shown in Figure 5-1.  The file name is a sequence of bytes in
   netascii terminated by a zero byte.  The mode field contains the
   string "netascii", "octet", or "mail" (or any combination of upper
   and lower case, such as "NETASCII", NetAscii", etc.) in netascii
   indicating the three modes defined in the protocol.  A host which
   receives netascii mode data must translate the data to its own
   format.  Octet mode is used to transfer a file that is in the 8-bit
   format of the machine from which the file is being transferred.  It
   is assumed that each type of machine has a single 8-bit format that
   is more common, and that that format is chosen.  For example, on a
   DEC-20, a 36 bit machine, this is four 8-bit bytes to a word with
   four bits of breakage.  If a host receives a octet file and then
   returns it, the returned file must be identical to the original.
   Mail mode uses the name of a mail recipient in place of a file and
   must begin with a WRQ.  Otherwise it is identical to netascii mode.
   The mail recipient string should be of the form "username" or
   "username@hostname".  If the second form is used, it allows the
   option of mail forwarding by a relay computer.

   The discussion above assumes that both the sender and recipient are
   operating in the same mode, but there is no reason that this has to
   be the case.  For example, one might build a storage server.  There
   is no reason that such a machine needs to translate netascii into its
   own form of text.  Rather, the sender might send files in netascii,
   but the storage server might simply store them without translation in
   8-bit format.  Another such situation is a problem that currently
   exists on DEC-20 systems.  Neither netascii nor octet accesses all
   the bits in a word.  One might create a special mode for such a
   machine which read all the bits in a word, but in which the receiver
   stored the information in 8-bit format.  When such a file is
   retrieved from the storage site, it must be restored to its original
   form to be useful, so the reverse mode must also be implemented.  The
   user site will have to remember some information to achieve this.  In
   both of these examples, the request packets would specify octet mode
   to the foreign host, but the local host would be in some other mode.
   No such machine or application specific modes have been specified in
   TFTP, but one would be compatible with this specification.

   It is also possible to define other modes for cooperating pairs of



Sollins                                                         [Page 6]


RFC 1350                    TFTP Revision 2                    July 1992


   hosts, although this must be done with care.  There is no requirement
   that any other hosts implement these.  There is no central authority
   that will define these modes or assign them names.


                   2 bytes     2 bytes      n bytes
                   ----------------------------------
                  | Opcode |   Block #  |   Data     |
                   ----------------------------------

                        Figure 5-2: DATA packet


   Data is actually transferred in DATA packets depicted in Figure 5-2.
   DATA packets (opcode = 3) have a block number and data field.  The
   block numbers on data packets begin with one and increase by one for
   each new block of data.  This restriction allows the program to use a
   single number to discriminate between new packets and duplicates.
   The data field is from zero to 512 bytes long.  If it is 512 bytes
   long, the block is not the last block of data; if it is from zero to
   511 bytes long, it signals the end of the transfer.  (See the section
   on Normal Termination for details.)

   All  packets other than duplicate ACK's and those used for
   termination are acknowledged unless a timeout occurs [4].  Sending a
   DATA packet is an acknowledgment for the first ACK packet of the
   previous DATA packet. The WRQ and DATA packets are acknowledged by
   ACK or ERROR packets, while RRQ


                         2 bytes     2 bytes
                         ---------------------
                        | Opcode |   Block #  |
                         ---------------------

                         Figure 5-3: ACK packet


   and ACK packets are acknowledged by  DATA  or ERROR packets.  Figure
   5-3 depicts an ACK packet; the opcode is 4.  The  block  number  in
   an  ACK echoes the block number of the DATA packet being
   acknowledged.  A WRQ is acknowledged with an ACK packet having a
   block number of zero.








Sollins                                                         [Page 7]


RFC 1350                    TFTP Revision 2                    July 1992


               2 bytes     2 bytes      string    1 byte
               -----------------------------------------
              | Opcode |  ErrorCode |   ErrMsg   |   0  |
               -----------------------------------------

                        Figure 5-4: ERROR packet


   An ERROR packet (opcode 5) takes the form depicted in Figure 5-4.  An
   ERROR packet can be the acknowledgment of any other type of packet.
   The error code is an integer indicating the nature of the error.  A
   table of values and meanings is given in the appendix.  (Note that
   several error codes have been added to this version of this
   document.) The error message is intended for human consumption, and
   should be in netascii.  Like all other strings, it is terminated with
   a zero byte.

6. Normal Termination

   The end of a transfer is marked by a DATA packet that contains
   between 0 and 511 bytes of data (i.e., Datagram length < 516).  This
   packet is acknowledged by an ACK packet like all other DATA packets.
   The host acknowledging the final DATA packet may terminate its side
   of the connection on sending the final ACK.  On the other hand,
   dallying is encouraged.  This means that the host sending the final
   ACK will wait for a while before terminating in order to retransmit
   the final ACK if it has been lost.  The acknowledger will know that
   the ACK has been lost if it receives the final DATA packet again.
   The host sending the last DATA must retransmit it until the packet is
   acknowledged or the sending host times out.  If the response is an
   ACK, the transmission was completed successfully.  If the sender of
   the data times out and is not prepared to retransmit any more, the
   transfer may still have been completed successfully, after which the
   acknowledger or network may have experienced a problem.  It is also
   possible in this case that the transfer was unsuccessful.  In any
   case, the connection has been closed.

7. Premature Termination

   If a request can not be granted, or some error occurs during the
   transfer, then an ERROR packet (opcode 5) is sent.  This is only a
   courtesy since it will not be retransmitted or acknowledged, so it
   may never be received.  Timeouts must also be used to detect errors.








Sollins                                                         [Page 8]


RFC 1350                    TFTP Revision 2                    July 1992


I. Appendix

Order of Headers

                                                  2 bytes
    ----------------------------------------------------------
   |  Local Medium  |  Internet  |  Datagram  |  TFTP Opcode  |
    ----------------------------------------------------------

TFTP Formats

   Type   Op #     Format without header

          2 bytes    string   1 byte     string   1 byte
          -----------------------------------------------
   RRQ/  | 01/02 |  Filename  |   0  |    Mode    |   0  |
   WRQ    -----------------------------------------------
          2 bytes    2 bytes       n bytes
          ---------------------------------
   DATA  | 03    |   Block #  |    Data    |
          ---------------------------------
          2 bytes    2 bytes
          -------------------
   ACK   | 04    |   Block #  |
          --------------------
          2 bytes  2 bytes        string    1 byte
          ----------------------------------------
   ERROR | 05    |  ErrorCode |   ErrMsg   |   0  |
          ----------------------------------------

Initial Connection Protocol for reading a file

   1. Host  A  sends  a  "RRQ"  to  host  B  with  source= A's TID,
      destination= 69.

   2. Host B sends a "DATA" (with block number= 1) to host  A  with
      source= B's TID, destination= A's TID.














Sollins                                                         [Page 9]


RFC 1350                    TFTP Revision 2                    July 1992


Error Codes

   Value     Meaning

   0         Not defined, see error message (if any).
   1         File not found.
   2         Access violation.
   3         Disk full or allocation exceeded.
   4         Illegal TFTP operation.
   5         Unknown transfer ID.
   6         File already exists.
   7         No such user.

Internet User Datagram Header [2]

   (This has been included only for convenience.  TFTP need not be
   implemented on top of the Internet User Datagram Protocol.)

     Format

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |          Source Port          |       Destination Port        |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |            Length             |           Checksum            |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+


   Values of Fields


   Source Port     Picked by originator of packet.

   Dest. Port      Picked by destination machine (69 for RRQ or WRQ).

   Length          Number of bytes in UDP packet, including UDP header.

   Checksum        Reference 2 describes rules for computing checksum.
                   (The implementor of this should be sure that the
                   correct algorithm is used here.)
                   Field contains zero if unused.

   Note: TFTP passes transfer identifiers (TID's) to the Internet User
   Datagram protocol to be used as the source and destination ports.






Sollins                                                        [Page 10]


RFC 1350                    TFTP Revision 2                    July 1992


References

   [1]  USA Standard Code for Information Interchange, USASI X3.4-1968.

   [2]  Postel, J., "User Datagram  Protocol," RFC 768, USC/Information
        Sciences Institute, 28 August 1980.

   [3]  Postel, J., "Telnet Protocol Specification," RFC 764,
        USC/Information Sciences Institute, June, 1980.

   [4]  Braden, R., Editor, "Requirements for Internet Hosts --
        Application and Support", RFC 1123, USC/Information Sciences
        Institute, October 1989.

Security Considerations

   Since TFTP includes no login or access control mechanisms, care must
   be taken in the rights granted to a TFTP server process so as not to
   violate the security of the server hosts file system.  TFTP is often
   installed with controls such that only files that have public read
   access are available via TFTP and writing files via TFTP is
   disallowed.

Author's Address

   Karen R. Sollins
   Massachusetts Institute of Technology
   Laboratory for Computer Science
   545 Technology Square
   Cambridge, MA 02139-1986

   Phone: (617) 253-6006

   EMail: SOLLINS@LCS.MIT.EDU

















Sollins                                                        [Page 11]

TFTP Trivial File Transfere Protocol

Motivation

College course project [ Computer Networks ]

Project documentation: link

Source: link

TFTP RFC Notes

1. Purpose

  • TFTP is a simple protocol to transfer files between two machines implementing UDP.
  • It has been implemented on top of the Internet User Datagram protocol
  • The only thing it can do is read and write files (or mail) from/to a remote server.
  • It has no provisions for user authentication
  • It passes 8 bit bytes of data.
  • Thee modes of transfere
    • Netascii
    • Octet
    • Mail

2. Overview of the Protocol

  • Any transfer begins with a request to read or write a file, which
    also serves to request a connection.
  • If the server grants the request, the connection is opened and the file is sent in fixed length blocks of 512 bytes
  • Each data packet contains one block of data, and must be acknowledged by an acknowledgment packet before the
    next packet can be sent.
  • A data packet of less than 512 bytes signals termination of a transfer.
  • If a packet gets lost in the network, the intended recipient will timeout and may retransmit his
    last packet (which may be data or an acknowledgment).
  • This causing the sender of the lost packet to retransmit that lost packet.
  • The sender has to keep just one packet on hand for retransmission
  • The lock step acknowledgment guarantees that all older packets have
    been received
  • Notice that both machines involved in a transfer are
    considered senders and receivers. One sends data and receives
    acknowledgments, the other sends acknowledgments and receives data.

Errors:

  • Most errors cause termination of the connection.
  • An error is signalled by sending an error packet, This packet is not acknowledged, and not retransmitted.
  • The other end of the connection may not get it. Therefore timeouts are used to detect such a termination when the error packet has been lost
  • Errors are caused by three types of events:
    • not being able to satisfy the request (e.g., file not found)
    • receiving a packet which cannot be explained by a delay or duplication in the network (e.g., an incorrectly formed packet)
    • losing access to a necessary resource (e.g., access denied during a transfer)
  • TFTP recognizes only one error condition that does not cause
    termination, the source port of a received packet being incorrect.
    In this case, an error packet is sent to the originating host.

This protocol is very restrictive, in order to simplify
implementation. For example, the fixed length blocks make allocation
straight forward, and the lock step acknowledgement provides flow
control and eliminates the need to reorder incoming data packets.

3. Relation to other Protocols

  • Since Datagram is implemented on the
    Internet protocol, packets will have an Internet header, a Datagram
    header, and a TFTP header.
  • TFTP does not specify any of the
    values in the Internet header. On the other hand, the source and
    destination port fields of the Datagram header (its format is given
    in the appendix) are used by TFTP and the length field reflects the
    size of the TFTP packet.
  • The Transfer IDentifiers (TID’s) used by
    TFTP are passed to the Datagram layer to be used as ports; therefore
    they must be between 0 and 65,535. The initialization of TID’s is
    discussed in the section on initial connection protocol.
  • The TFTP header consists of a 2 byte opcode field which indicates
    the packet’s type (e.g., DATA, ERROR, etc.) These opcodes and the
    formats of the various types of packets are discussed further in the
    section on TFTP packets.

4. Initial Connection Protocol

  • A transfer is established by sending a request (WRQ to write onto a
    foreign file system, or RRQ to read from it), and receiving a
    positive reply, an acknowledgment packet for write, or the first data
    packet for read.
  • In general an acknowledgment packet will contain
    the block number of the data packet being acknowledged.
  • Each data packet has associated with it a block number; block numbers are
    consecutive and begin with one.
  • Since an acknowledgment packet is acknowledging a data packet, the acknowledgment packet will
    contain the block number of the data packet being acknowledged.
  • If the reply is an error packet, then the request has been denied.

  • In order to create a connection, each end of the connection chooses a TID for itself, to be used for the duration of that connection.
  • TID’s chosen for a connection should be randomly chosen, so that the probability that the same number is chosen twice in immediate succession is very low.
  • Every packet has associated with it the two TID’s of the ends of the connection, the source TID and the destination TID.
  • These TID’s are handed to the supporting UDP (or other datagram protocol) as the source and destination ports
  • A requesting host chooses its source TID, and sends its initial request to the known TID 69 decimal (105 octal) on the serving host.
  • The response to this request, uses a random TID chosen by the server as its source TID and the TID chosen for the previous message by the requestor as its destination TID.
  • The two chosen TID’s are then used for the remainder of the transfer.

Example shows how to establish a connection to write a file

  1. Host A sends a «WRQ» to host B with source= A’s TID, destination= 69.
  2. Host B sends a «ACK» (with block number= 0) to host A with source= B’s TID, destination= A’s TID.

Wrong port error

  • In the next step, and in all succeeding steps, the hosts should make sure that the source TID matches the value that was agreed on in steps 1 and 2.
  • If a source TID does not match, the packet should be discarded as erroneously sent from somewhere else.
  • An error packet should be sent to the source of the incorrect packet, while not disturbing the transfer.

Example for this error type

The following example demonstrates a correct operation of the protocol in which the above situation can occur. Host A sends a request to host B. Somewhere in the network, the request packet is duplicated, and as a result two acknowledgments are returned to host A, with different TID’s chosen on host B in response to the two requests. When the first response arrives, host A continues the connection. When the second response to the request arrives, it should be rejected, but there is no reason to terminate the first connection. Therefore, if different TID’s are chosen for the two connections on host B and host A checks the source TID’s of the messages it receives, the first connection can be maintained while the second is rejected by returning an error packet.

5. TFTP Packets

TFTP supports five types of packets, all of which have been mentioned
above:

opcode operation
1 Read request (RRQ)
2 Write request (WRQ)
3 Data (DATA)
4 Acknowledgment (ACK)
5 Error (ERROR)

The TFTP header of a packet contains the opcode associated with that packet.

5.1RRQ/WRQ packet

2 bytes string 1 byte string 1 byte
Opcode Filename 0 Mode 0
  • The file name is a sequence of bytes in netascii terminated by a zero byte.
  • The mode field contains the string «netascii», «octet», or «mail».
  • Octet mode is used to transfer a file that is in the 8-bit format of the machine from which the file is being transferred.
  • It is assumed that each type of machine has a single 8-bit format that is more common, and that that format is chosen.

5.2 DATA packet

2 bytes 2 bytes n bytes
Opcode Block # Data
  • Data is actually transferred in DATA packets depicted in Figure 5-2. DATA packets (opcode = 3) have a block number and data field.
  • The block numbers on data packets begin with one and increase by one for each new block of data.
  • This restriction allows the program to use a single number to discriminate between new packets and duplicates.
  • The data field is from zero to 512 bytes long. If it is 512 bytes long, the block is not the last block of data; if it is from zero to 511 bytes long, it signals the end of the transfer. (See the section on Normal Termination for details.)

5.3 Acknowledgments

All packets other than duplicate ACK’s and those used for termination are acknowledged unless a timeout occurs [4]. Sending a DATA packet is an acknowledgment for the first ACK packet of the previous DATA packet. The WRQ and DATA packets are acknowledged by ACK or ERROR packets, while RRQ and ACK packets are acknowledged by DATA or ERROR packets.

2 bytes 2 bytes
Opcode Block #
  • The opcode is 4.
  • The block number in an ACK echoes the block number of the DATA packet being acknowledged.
  • A WRQ is acknowledged with an ACK packet having a block number of zero.

5. 4 Error Packet

2 bytes 2 bytes string 1 byte
Opcode ErrorCode ErrMsg 0
  • An ERROR packet (opcode 5) takes the form depicted in Figure 5-4.
  • An ERROR packet can be the acknowledgment of any other type of packet.
  • The error code is an integer indicating the nature of the error.
  • A table of values and meanings is given in the appendix. (Note that several error codes have been added to this version of this document.)
  • The error message is intended for human consumption, and should be in netascii. Like all other strings, it is terminated with a zero byte.

6. Normal Termination

  • The end of a transfer is marked by a DATA packet that contains
    between 0 and 511 bytes of data (i.e., Datagram length < 516). This
    packet is acknowledged by an ACK packet like all other DATA packets.
  • The host acknowledging the final DATA packet may terminate its side
    of the connection on sending the final ACK.
  • On the other hand,
    dallying is encouraged. This means that the host sending the final
    ACK will wait for a while before terminating in order to retransmit
    the final ACK if it has been lost.
  • The acknowledger will know that
    the ACK has been lost if it receives the final DATA packet again.
  • The host sending the last DATA must retransmit it until the packet is
    acknowledged or the sending host times out.
  • If the response is an
    ACK, the transmission was completed successfully.
  • If the sender of
    the data times out and is not prepared to retransmit any more, the
    transfer may still have been completed successfully, after which the
    acknowledger or network may have experienced a problem.
  • It is also
    possible in this case that the transfer was unsuccessful. In any
    case, the connection has been closed.

7. Premature Termination

  • If a request can not be granted, or some error occurs during the
    transfer, then an ERROR packet (opcode 5) is sent.
  • This is only a courtesy since it will not be retransmitted or acknowledged, so it may never be received. Timeouts must also be used to detect errors.

Init/Boot/Loader Codes

  • PXE-E00: Could not find enough free base memory.

PXE BaseCode and UNDI runtime modules are copied from FLASH or upper memory into the top of free base memory between 480K (78000h) and 640K (A0000h). This memory must be zero-filled by the system BIOS. If this memory is not zero-filled, the relocation code in the PXE ROMs will assume that this memory is being used by the system BIOS or other boot ROMs.

  • PXE-E01: PCI Vendor and Device IDs do not match!

This message should never be seen in a production BIOS. When the system BIOS initializes a PCI option ROM, it is supposed to pass the PCI bus/device/function numbers in the AX register. If the PCI device defined in the AX register does not match the UNDI device, this error is displayed.

  • PXE-E04: Error reading PCI configuration space.

This message is displayed if any of the PCI BIOS calls made to read the PCI configuration space return an error code. This should not happen with a production BIOS and properly operating hardware.

  • PXE-E05: EEPROM checksum error.

This message is displayed if the NIC EEPROM contents have been corrupted. This can happen if the system is reset or powered down when the NIC EEPROM is being reprogrammed. If this message is displayed the PXE ROM will not boot.

  • PXE-E06: Option ROM requires DDIM support.

This message should not be seen in a production BIOS. PCI option ROMs must always be installed as DDIM option ROMs (they must be installed into read/write upper memory).

  • PXE-E07: PCI BIOS calls not supported.

This message should not be seen in a production BIOS. PCI BIOS must have PCI BIOS services.

  • PXE-E08: Unexpected API error. API: xxxxh Status: xxxxh

This message is displayed if a PXE API returns a status code that is not expected by the runtime loader.

  • PXE-E09: Unexpected UNDI loader error. Status: xxxxh

This message is displayed if the UNDI runtime loader returns an unexpected status code.

ARP Codes

  • PXE-E11: ARP timeout.

The PXE ROM will retry the ARP request four times. If it does not get any valid ARP replies, this message is displayed. This error can be caused by a number of network and service configuration errors. The most common are:

  1. Setting the DHCP Class Identifier (option 60) on the DHCP server and installing the proxyDHCP on a separate machine.
  2. Using routers that do not respond to ARP requests.

BIOS and BIS Codes

  • PXE-E20: BIOS extended memory copy error. AH == nn

This message is displayed if the BIOS extended memory copy service returns an error. This should not happen on a production BIOS. The variable «nn» is the BIOS error code returned by the BIOS extended memory copy service (Int 15h, AH = 87h).

  • PXE-E21: BIS integrity check failed.

This message is displayed if the BIS image in extended memory has been corrupted.

  • PXE-E22: BIS image/credential validation failed.

The downloaded image and credential do not match the client key.

  • PXE-E23: BIS initialization failed.

BIS could not be initialized. No more data is available.

  • PXE-E24: BIS shutdown failed.

BIS could not be shutdown. No more data is available.

  • PXE-E25: BIS get boot object authorization check flag failed.

Could not determine if BIS is enabled/disabled.

  • PXE-E26: BIS free memory failed.

Could not release BIS allocated memory.

  • PXE-E27: BIS get signature information failed.

Required BIS credential type information could not be determined.

  • PXE-E28: BIS bad entry structure checksum.

BIS entry structure in the SM BIOS table is invalid.

TFTP/MTFTP Codes

  • PXE-E32: TFTP open timeout.

TFTP open request was not acknowledged. Verify that the TFTP service is running.

  • PXE-E35: TFTP read timeout.

Next TFTP data packet was not received.

  • PXE-E36: Error received from TFTP server.

A TFTP error packet was received from the TFTP server.

  • PXE-E38: TFTP cannot open connection.

A hardware error occurred when trying to send the TFTP open packet out.

  • PXE-E39: TFTP cannot read from connection.

A hardware error occurred when trying to send a TFTP acknowledge packet out.

  • PXE-E3A: TFTP too many packages.

This message can mean one of two things: PXE-E3B: TFTP error — File not found.
The requested file was not found on the TFTP server.

  • PXE-E3C: TFTP error ? Access violation.

The request file was found on the TFTP server. The TFTP service does not have enough access rights to open/read the file.

  • PXE-E3F: TFTP packet size is invalid.

The TFTP packet received is larger than 1456 bytes.

Using TFTP, you are trying to download a file that is larger than the allocated buffer.

Using MTFTP, you started downloading a file as a slave client, and the file increased in size when you became the master client.

BOOTP/DHCP Codes

  • PXE-E51: No DHCP or proxyDHCP offers were received.

The client did not receive any valid DHCP, BOOTP, or proxyDHCP offers.

  • PXE-E52: proxyDHCP offers were received. No DHCP offers were received.

The client did not receive any valid DHCP or BOOTP offers. The client did receive at least one valid proxyDHCP offer.

  • PXE-E53: No boot filename received.

The client received at least one valid DHCP/BOOTP offer but does not have a boot filename to download.

  • PXE-E55: proxyDHCP service did not reply to request on port 4011.

The client issued a proxyDHCP request to the DHCP server on port 4011 but did not receive a reply.

UNDI Codes

  • PXE-E60: Invalid UNDI API function number.

An API being used by the BaseCode is not implemented in the UNDI ROM.

  • PXE-E61: Media test failed, check cable.

Most likely the cable is not plugged in or connected. Could be a bad cable, NIC, or connection.

  • PXE-E63: Error while initializing the NIC.

An error occurred while trying to initialize the NIC hardware. Try another NIC.

  • PXE-E64: Error while initializing the PHY.

An error occurred while trying to initialize the PHY hardware. Try another NIC.

  • PXE-E65: Error while reading the configuration data

An error occurred while reading the NIC configuration data. Try another NIC.

  • PXE-E66: Error while reading the initialization data.

An error occurred while reading the NIC initialization data. Try another NIC.

  • PXE-E67: Invalid MAC address.

The MAC address stored in this NIC is invalid. Try another NIC.

  • PXE-E68: Invalid EEPROM checksum.

The EEPROM checksum is invalid. The contents of the EEPROM have been corrupted. Try another NIC.

  • PXE-E69: Error while setting interrupt.

The interrupt hardware could not be configured. Try another NIC.

Bootstrap and Discovery Codes

  • PXE-E74: Bad or missing PXE menu and/or prompt information.

PXE tags were detected, but the boot menu and/or boot prompt tags were not found/valid.

  • PXE-E76: Bad or missing multicast discovery address.

Multicast discovery is enabled but the multicast discovery address tag is missing.

  • PXE-E77: Bad or missing discovery server list.

Multicast and broadcast discovery are both disabled, or use server list is enabled, and the server list tag was not found/valid.

  • PXE-E78: Could not locate boot server.

A valid boot server reply was not received by the client.

  • PXE-E79: NBP is too big to fit in free base memory.

The NBP is larger than the amount of free base memory.

  • PXE-E7A: Client could not locate a secure server.

This message is displayed when the client did not receive any security information from the boot server and BIS is enabled on the client.

  • PXE-E7B: Missing MTFTP server IP address.

This message is displayed when the ROM did not receive any PXE discovery tags or proxyDHCP offers and the DHCP SIADDR field is set to 0.0.0.0.

APITest.0 and DOSUNDI.0 Codes

  • PXE-E81: !PXE structure is invalid.

The !PXE structure is missing or has been corrupted.

  • PXE-E82: PXENV+ structure is invalid.

The PXENV+ structure is missing or has been corrupted.

  • PXE-E83: Invalid DHCP option format.

PXE discovery tags in the cached packets are not valid.

  • PXE-E84: Could not get pointer to original packet storage.

The PXE ROM being used did not return pointers to its local cached packet storage. The API test bootstrap program will not work with this boot ROM.

  • PXE-E85: Not enough extended memory.

The size of the RAMdisk image is larger that the available extended memory.

  • PXE-E86: ENV RAMdisk image corrupted.

The bootstrap program was expecting a DOS diskette image. The first 512 bytes of the downloaded image did not contain a DOS boot signature.

  • PXE-E87: Could not find selected boot item.

The cached discovery reply packet did not contain a PXE boot-item tag (PXE option 71).

  • PXE-E88: Could not locate boot server.

The bootserver did not reply to the RAMdisk image discovery request. The RAMdisk image is not on the bootserver, or the bootserver service is not running.

  • PXE-E89: Could not download boot image.

The RAMdisk image could not be downloaded. The RAMdisk image is not on the bootserver, or the TFTP service on the bootserver is not running.

Miscellaneous Codes

  • PXE-EA0: Network boot canceled by keystroke.

User pressed ESC during DHCP/Discovery/TFTP.

BaseCode/UNDI Loader Codes

  • PXE-EC1: BaseCode ROM ID structure was not found.

UNDI boot module could not find the BaseCode ROM ID structure. If there is a BaseCode ROM image in the system, it has probably been corrupted.

  • PXE-EC3: BaseCode ROM ID structure is invalid.

The BaseCode ROM ID structure is invalid. The BaseCode ROM image has probably been corrupted.

  • PXE-EC4: UNDI ROM ID structure was not found.

The BaseCode loader module could not locate the UNDI ROM ID structure.

  • PXE-EC5: UNDI ROM ID structure is invalid.

The UNDI ROM image has probably been corrupted.

  • PXE-EC6: UNDI driver image is invalid.

The UNDI ROM image has probably been corrupted.

  • PXE-EC8: !PXE structure was not found in UNDI driver code segment.

The UNDI ROM image has probably been corrupted or has not been initialized by the BIOS. This error is most often caused by one of three things:

  1. A NIC image was programmed into a BIOS when a .LOM image should have been used.
  2. The memory allocated by the POST Memory Manager ($PMM) during PXE option ROM initialization has been corrupted or erased before PXE option ROM boot.
  3. The UNDI_Loader structure was not properly initialized during option ROM initialization.
  • PXE-EC9: PXENV+ structure was not found in UNDI driver code segment.

The UNDI ROM image has probably been corrupted or has not been initialized by the BIOS. This error is most often caused by one of three things:

  1. A NIC image was programmed into a BIOS when a .LOM image should have been used.
  2. The memory allocated by the POST Memory Manager ($PMM) during PXE option ROM initialization has been corrupted or erased before PXE option ROM boot.
  3. The UNDI_Loader structure was not properly initialized during option ROM initialization.

Appendix A

Using a TFTP Server

c.

Step 3

Enter the following command:

/etc/init.d/xinetd restart

TFTP Download Error Codes

PDM cannot be downloaded via TFTP from the PIX Firewall unit’s monitor mode. You must use the

copy tftp flash:pdm command described in

During a TFTP download, non-fatal errors may appear in the midst of dots that display as the software

downloads. The error code appears inside angle brackets.

For example, random bad blocks appear as follows:

….<11>..<11>.<11>……<11>…

Also, the display may show «A» and «T» for ARP and timeouts, respectively. Receipt of non-IP packets

causes the protocol number to display inside parentheses.

Table A-1

Error

Code

-1

2

3

4

5

6

7

8

9

10

-10

11

Error codes 9 and 10 cause the download to stop.

78-15483-01

If you want to specify a different TFTP directory, replace «/tftpboot» in the line «server_args = -s

/tftpboot» with the name of your directory.

TFTP Error Code Numeric Values

Description

Timeout between the PIX Firewall and TFTP server.

The packet length as received from the Ethernet device was not big enough to be a valid

TFTP packet.

The received packet was not from the server specified in the server command.

The IP header length was not big enough to be a valid TFTP packet.

The IP protocol type on the received packet was not UDP, which is the underlying protocol

used by TFTP.

The received IP packet’s destination address did not match the address specified by the

address command.

The UDP ports on either side of the connection did not match the expected values. This

means either the local port was not the previously selected port, or the foreign port was not

the TFTP port, or both.

The UDP checksum calculation on the packet failed.

An unexpected TFTP code occurred.

A TFTP transfer error occurred.

The image filename you specified cannot be found. Check the spelling of the filename and

that permissions permit the TFTP server to access the file. In UNIX, the file needs to be

world readable.

A TFTP packet was received out of sequence.

Chapter 3, «Installing PDM.»

Table A-1

lists the code values.

Cisco PIX Device Manager Installation Guide

TFTP Download Error Codes

A-3

Понравилась статья? Поделить с друзьями:
  • Terminator resistance как изменить разрешение экрана
  • Terraria error system dllnotfoundexception
  • Test drive unlimited 2 ошибка при запуске
  • Terminating the instance due to error 474
  • Tftp error code 2 received 16739