0

I have a strange case where I don't know what happen. Usually using tcpdump shall allow us to know if a packet reach to the NIC before iptable filter. This works so far on most UDP port I tried but not port 69.

I have a server (IP: 192.168.0.10) running

# tcpdump -nnvv src host 192.168.0.128

Both host 192.168.0.10 are connected non managed switch. The network is working fine. I can ping each others and I even can connect to other TCP services.

When I send a UDP traffic from host 192.168.0.128:

# echo "test" > /dev/udp/192.168.0.10/100

I receive response from 192.168.0.10:

12:29:09.210977 IP (tos 0x0, ttl 64, id 50828, offset 0, flags [DF], proto UDP (17), length 33)
    192.168.0.128.33701 > 192.168.0.10.100: [udp sum ok] UDP, length 5
12:29:14.211507 ARP, Ethernet (len 6), IPv4 (len 4), Reply 192.168.0.128 is-at 00:0c:29:e8:30:d4, length 46

Even the UDP port 100 isn't listened by any service. I also try other UDP port like 67, 68, 101 and 102. All these ports work perfectly well.

Next I try send a UDP traffic to port 69:

# echo "test" > /dev/udp/192.168.0.10/69

And I receive no response tcpdump. As port 69 is usually used by tftp service. I perform this test is trying to troubleshot why the tftp listen on port 69 isn't showing any response. I also make sure the tftp service is stop before I do the test.

My Linux kernel is:

# uname -a
Linux local 2.6.33.3-85.fc13.x86_64 #1 SMP Thu May 6 18:09:49 UTC 2010 x86_64 x86_64 x86_64 GNU/Linux

Is there any other setting in Linux box that hijack the UDP port 69 traffic?

  • 1
    Does your nic support network boot? it may be intercepting tftp traffic and processing it in firmware before it gets to the OS stack. – Frank Thomas Jun 2 '17 at 4:47
  • @FrankThomas. Yes my NIC support network boot. But that is not the issue first. In my testing, I have two machine boot into Linux OS, then I send a udp traffic from one machine B to machine A's UDP port 69. Why I couldn't detect the traffic from it? Other UDP port is fine so far. – Chau Chee Yang Jun 2 '17 at 5:21
  • I think Frank is saying your NIC may be running a tftp client on the NIC itself (not in Linux), and the NIC's tftp client is eating up packets to UDP port 69 and not passing them up to the host OS. – Spiff Jun 2 '17 at 6:27
  • @Spiff: I didn't aware if my NIC is running any tftp client. To my best knowledge, I think it should not have tftp client running. How may I confirm that? – Chau Chee Yang Jun 2 '17 at 6:57
  • It is working now. I am using a Dlink DGS-1210 network switch. The default switch IP address is 10.90.90.90. I set the IP address to 192.168.0.1, and traffic to udp port 69 flow works. However, I still has no clue why it work. I have double check the network switch if there are anything related to port 69 (TFTP), but I couldn't find any. – Chau Chee Yang Jun 3 '17 at 1:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.