TFTP: Why a Protocol With No Security Is Still on Your Network
Trivial File Transfer Protocol is deliberately minimal: no authentication, no encryption, no directory listing, no way to delete or rename. It runs on UDP port 69 and does two things — read a file, write a file. That minimalism is why it is still deployed decades after it should have disappeared, and also why it is a liability wherever it is reachable. How it works A client sends a read or write request to UDP 69. The server responds from a different , ephemeral port, and the rest of the transfer continues between the client's port and that one. This surprises people configuring firewalls: opening UDP 69 alone is not enough, and stateful inspection or a protocol helper is needed for the transfer to complete. Data moves in fixed-size blocks, traditionally 512 bytes, each acknowledged before the next is sent. That lockstep behavior makes it simple to implement and slow over links with any latency. A block smaller than the full size signals the end of the file. Because UDP provi...