Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 4 down vote favorite

Recently snort notified me that I have a user's computer on my network initiating an outbound TFTP request. The odd thing is the destination is 255.255.255.255

Anyone have a clue as to what this may be?

Recored Payloads:

0000000: 00 01 72 6f 75 74 65 72 2e 63 6f 6e 66 00 6e 65 74 61 73 63 69 69 00 ..router.conf.netascii.

0000000: 00 01 42 6f 6f 74 5c 78 38 36 5c 77 64 73 6e 62 70 2e 63 6f 6d 00 6e 65 74 61 ..Boot\x86\wdsnbp.com.neta 000001A: 73 63 69 69 00 scii.

share|improve this question
2  
It's probably an attempt to discover TFTP servers on the network, since 255.255.255.255 is the IP broadcast address. I can't give you any more information without doing some research through. Got a pcap file we can take a look at? – Polynomial Jul 3 '12 at 15:20
Its a TFTP server with no ip number so you need to track it with it's mac address. – Andrew Smith Jul 3 '12 at 15:33
Some non-PC devices broadcast TFTP requests. Perhaps this is coming from such a device, e.g. an IP phone and not their computer? – chao-mu Jul 3 '12 at 16:03
All I have is the payload recorded by snort. – k to the z Jul 3 '12 at 16:28

1 Answer

up vote 5 down vote accepted 
0000000: 00 01 72 6f 75 74 65 72 2e 63 6f 6e 66 00 6e 65 74 61 73 63 69 69 00
..router.conf.netascii.

That's probably a router, requesting the router.conf file in netascii encoding.

0000000: 00 01 42 6f 6f 74 5c 78 38 36 5c 77 64 73 6e 62 70 2e 63 6f 6d 00 6e 65 74 61
000001A: 73 63 69 69 00
..Boot\x86\wdsnbp.com.netascii.

That's a Windows PE attempt at booting via PXE.

Since TFTP uses UDP as a transport (keeping coding overhead very light, hence Trvial FTP), it can also be accessed by using the broadcast address allowing a machine that has booted with no configuration info about the network at all to grab configuration files or executables to assist in the boot process.

Record and track associated addresses if you want to figure out what was going on. The triage, however, is normal netboot operations. That said, this could still be handy for an intruder in some ways.

share|improve this answer
Checking with my client support guys to see if they were pxe booting that machine. – k to the z Jul 3 '12 at 16:42
Yes sir. Thank you. – k to the z Jul 3 '12 at 18:43

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.