tftp | index /build/dshell/src/dshell/decoders/tftp/tftp.py |
TFTP Decoder
In short:
Goes through UDP traffic, packet by packet, and ties together TFTP file
streams. If the command line argument is set (--tftp_rip), it will dump the
files to a directory (--tftp_outdir=<DIR>)
In long:
Goes through each UDP packet and parses out the TFTP opcode. For read or
write requests, it sets a placeholder in unsetReadStreams or unsetWriteStreams,
respectively. These placeholders are moved to openStreams when we first see
data for the read request or an ACK code for a write request. The reason for
these placeholders is to allow the server to set the ephemeral port during
data transfer.
When it sees a DATA packet, it stores the data under the IP-port-IP-port
openStream key as 'filedata'. Each of these data packets has an ordered block
number, and the file data is stored under that block number. It is reassembled
later. When we consider a stream finished (either the DATA packet is too short
or there are no more packets), we rebuild the file data, print information
about the stream, dump the file (optional), and move the information from
openStreams to closedStreams.
Example:
Running on sample pcap available here: https://wiki.wireshark.org/TFTP
With default values, it will display transfers performed
Dshell> decode -d tftp ~/pcap/tftp_*.pcap
tftp 2013-05-01 08:24:11 192.168.0.253:50618 -- 192.168.0.10:3445 ** read rfc1350.txt (24599 bytes) **
tftp 2013-04-27 05:07:59 192.168.0.1:57509 -- 192.168.0.13:2087 ** write rfc1350.txt (24599 bytes) **
With the --tftp_rip flag, it will generate the same output while reassembling
the files and saving them in a defined directory (./tftp_out by default)
Dshell> decode -d tftp --tftp_rip --tftp_outdir=./MyTFTP ~/pcap/tftp_*.pcap
tftp 2013-05-01 08:24:11 192.168.0.253:50618 -- 192.168.0.10:3445 ** read rfc1350.txt (24599 bytes) **
tftp 2013-04-27 05:07:59 192.168.0.1:57509 -- 192.168.0.13:2087 ** write rfc1350.txt (24599 bytes) **
Dshell> ls ./MyTFTP/
rfc1350.txt rfc1350.txt_01
Note: The two files have the same name in the traffic, but have incremented
filenames when saved
Modules | ||||||
|
Classes | ||||||||||
|
Data | ||
dObj = tftp udp rip=None outdir=None |