4

Recently snort notified me that I have a user's computer on my network initiating an outbound TFTP request. The odd thing is the destination is 255.255.255.255

Anyone have a clue as to what this may be?

Recored Payloads:

0000000: 00 01 72 6f 75 74 65 72 2e 63 6f 6e 66 00 6e 65 74 61 73 63 69 69 00 ..router.conf.netascii.

0000000: 00 01 42 6f 6f 74 5c 78 38 36 5c 77 64 73 6e 62 70 2e 63 6f 6d 00 6e 65 74 61 ..Boot\x86\wdsnbp.com.neta 000001A: 73 63 69 69 00 scii.

  • 2
    It's probably an attempt to discover TFTP servers on the network, since 255.255.255.255 is the IP broadcast address. I can't give you any more information without doing some research through. Got a pcap file we can take a look at? – Polynomial Jul 3 '12 at 15:20
  • Its a TFTP server with no ip number so you need to track it with it's mac address. – Andrew Smith Jul 3 '12 at 15:33
  • Some non-PC devices broadcast TFTP requests. Perhaps this is coming from such a device, e.g. an IP phone and not their computer? – chao-mu Jul 3 '12 at 16:03
  • All I have is the payload recorded by snort. – k to the z Jul 3 '12 at 16:28
6
0000000: 00 01 72 6f 75 74 65 72 2e 63 6f 6e 66 00 6e 65 74 61 73 63 69 69 00
..router.conf.netascii.

That's probably a router, requesting the router.conf file in netascii encoding.

0000000: 00 01 42 6f 6f 74 5c 78 38 36 5c 77 64 73 6e 62 70 2e 63 6f 6d 00 6e 65 74 61
000001A: 73 63 69 69 00
..Boot\x86\wdsnbp.com.netascii.

That's a Windows PE attempt at booting via PXE.

Since TFTP uses UDP as a transport (keeping coding overhead very light, hence Trvial FTP), it can also be accessed by using the broadcast address allowing a machine that has booted with no configuration info about the network at all to grab configuration files or executables to assist in the boot process.

Record and track associated addresses if you want to figure out what was going on. The triage, however, is normal netboot operations. That said, this could still be handy for an intruder in some ways.

  • Checking with my client support guys to see if they were pxe booting that machine. – k to the z Jul 3 '12 at 16:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.