Server - Tftp

Only run TFTP on a trusted, private management VLAN. Never expose a TFTP server to the public internet.

TFTP operates on the transport protocol, typically using Port 69 to listen for requests. TFTP Server

| Risk | Mitigation | |-------|-------------| | | Anyone can read/write if server permits. Use --create only when necessary. | | No encryption | Credentials (if any fake ones) and data are plaintext. Use IPSec or VPN if needed. | | Directory traversal | --secure chroots the TFTP root. Avoid symbolic links pointing outside. | | DoS / Amplification | Rate-limit UDP/69. Use tftp-max-blocksize to cap resources. | | Firmware poisoning | Serve signed firmware images; validate hash on client. | Only run TFTP on a trusted, private management VLAN

Because UDP is "connectionless," TFTP handles its own error recovery. If an ACK doesn’t arrive within a certain timeframe, the server simply re-sends the last block. Key Use Cases: Why We Still Use It | Risk | Mitigation | |-------|-------------| | |

The server sends the file in fixed-size blocks (usually 512 bytes).