Mathew Want wrote:
> Craig,
>
> I had an instance last week where we were trying to block the reply traffic
> from a TFTP server with an ACL (the joys of an exercise in a Cisco course).
> What the instructor found was that in one of the RFC's (or similar tech doc)
> that some implementations of TFTP servers, although contacted on UDP/69,
> answer on udp/XX69. This would get dropped by a firewall tracking the UDP
> traffic as it would appear as a new connection rather than a reply to an
> existing one.
>
> Hope this helps.
That's how _all_ TFTP works - I suggest reading the RFC (1350).
<client:udp:anon-port-C> -> <server:udp:69>
<server:udp:anon-port-S> -> <client:udp:anon-port-C>
<client:udp:anon-port-C> -> <server:udp:anon-port-S>
TFTP is evil...
--
Carson
_______________________________________________
firewall-wizards mailing list
firewall-wizards@listserv.icsalabs.com
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards
|