How TFTP works

In this tutorial lesson we will learn how TFTP works and how a file is copied from a TFTP Server to TFTP Client.

Before continuing, I strongly suggest you to visit following lessons to understand the technical terms related with TFTP (Trivial File Transfer Protocol).

TFTP RRQ (Read Request) and TFTP WRQ (Write Request) messages

Mainly there are two types of TFTP requests.

TFTP RRQ (Read Request) message packet is used to read a file from the root folder of the TFTP server.
TFTP WRQ (Write Request) message packet is used to write a file to the root folder of the TFTP server.

TFTP RRQ (Read Request) and TFTP WRQ (Write Request) messages are also are also used to establish a TFTP connection from a TFTP Client to a TFTP Server. Once the TFTP RRQ message or TFTP WRQ message is received at the TFTP Server, the data transfer is started either from the TFTP Server side or TFTP Client side.

TFTP DATA packet size

In TFTP, the file is divided in to different blocks of data consisting of 512 bytes, except the for the last block. The last block is identified by its size less than 512 bytes. The size of last block is between 0 and 511 bytes. In below example, we are trying to copy a file named "yamaha-rx100.txt" from the root folder of the TFTP Server to the TFTP Client. The size of the file is 1.59 KB (1,630 bytes). Since the file size is 1,630 bytes, there must be four Blocks of Data packets, from TFTP Server to TFTP Client.

Please refer below table and then compare with the capture screenshot images provided at each steps below to understand the concept.

Sl. No.	Block Number	Block Size
1	Block Number 1	512 bytes
2	Block Number 2	512 bytes
3	Block Number 3	512 bytes
4	Block Number 4	94 bytes
Total		1630 bytes

To keep the protocol simple, TFTP uses UDP instead of TCP at Transport Layer. UDP is not a reliable protocol. To provide basic level of reliability, TFTP uses ACK messages to confirm the receipt of blocks of data. When a block of data is received by TFTP client or TFTP Server, a TFTP ACK message is sent back to acknowledge the receipt of the Block of Data. If a Block of data is lost in transfer, TFTP Client will not send the acknowledgement message. Then, a timeout will happen at the TFTP Server, and the lost TFTP DATA packet is sent again.

TFTP port numbers

By default, TFTP Server is listening to UDP port 69, but you can make it listen any UDP port number, by changing the port number configuration at the TFTP Server. Initial TFTP RRQ (Read Request) and TFTP WRQ (Write Request) message packets are sent to UDP port 69. Further communications from TFTP Server back to the TFTP Client is from a random port number belongs to Dynamic port number range.

TFTP Client uses a random port number belongs to Dynamic port number range.

You can verify the UDP ports used by TFTP Server and TFTP Client at packet capture screenshots copied in each of the below steps. First image in each step shows a graphical representation of the direction of packet flow and the second image is Wireshark capture screenshot of the corresponding TFTP message.

How TFTP (Trivial File Transfer Protocol) works

Below example explains about TFTP RRQ (Read Request) message and how file copy from TFTP Server to TFTP Client works. TFTP WRQ (Write Request) message and file write process to the TFTP Server works similar to below example, but with reverse flow of TFTP DATA packets and TFTP ACK packets.

The IP addresses of the TFTP Client computer and the TFTP Server computer used in this example are 192.168.10.100 and 192.168.10.10 respectively.

Step 1 - The first step in coping a file from TFTP Server to TFTP Client is by sending a TFTP RRQ (Read Request) message packet to the TFTP server. By default, TFTP Server is listening to UDP port 69 and therefore the initial TFTP RRQ (Read Request) message is sent to UDP port 69.

The Opcode for TFTP RRQ message is 1 and TFTP WRQ message is 2. Mode (Type) of transfer for text file is netascii.

Step 2 - When a TFTP RRQ (Read Request) message is received to copy a file, TFTP server will reply back either with the first Block of data or with a TFTP ERROR message. Here in this case, everything is perfect and the reply is with first block of data (512 bytes).

Main point to note here is that further communications from TFTP Server to TFTP Client is not from UDP port 69. TFTP Server selects a dynamic UDP port number above 1023 for all further communications.

Step 3 - As discussed above, in TFTP, file transfer is made by slicing the file into blocks of data and sending blocks of data to the recipient. You can see that there are four blocks in this example, and they are sent in order from Block number 1 to Block number 4 to TFTP Client. TFTP Client acknowledges each Block of data by replying with a TFTP ACK message packet.

Once the first Block of data is received, the TFTP Client will send back the acknowledgement for the first Block of data (Block number 1).

Step 4 - Once the TFTP ACK message for first Block of Data is received from the TFTP Client, the TFTP Server sends the second Block of Data.

Step 5 - Once the second Block of data is received, the TFTP Client will send back the acknowledgement for the second Block of data.

Step 6 - Once the TFTP ACK message for the second Block of Data received, the TFTP Server sends the third Block of data.

Step 7 - Once the third Block of data is received, the TFTP Client will send back the acknowledgement for the third Block of data.

Step 8 - In this example, the total size of the file being transferred is 1,630 bytes. 1,536 bytes of data is already transferred in previous three blocks of Data transfer (512 x 3). Remaining is 94 bytes of data to transfer to the TFTP Client. Once the TFTP ACK message for the third Block of Data received, the TFTP Server sends the last Block of data, consisting of remaining 94 bytes of data.

Again, note that in TFTP, the last Block of Data is identified by its file size, which is less than 512 bytes (in this example 94 bytes).