axlrose_tcpdump

gps ~ # tcpdump -c 100 -i eth0 udp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 68 bytes
10:37:48.014486 IP 192.168.1.88.2652 > 192.168.1.123.tftp:  17 RRQ "tftp.txt" octet
10:37:48.015590 IP 192.168.1.123.1034 > 192.168.1.1.domain:  23548+[|domain]
10:37:48.017457 IP 192.168.1.123.1035 > 192.168.1.1.domain:  21248+[|domain]
10:37:48.029581 IP 192.168.1.1.domain > 192.168.1.123.1034:  23548[|domain]
10:37:48.030154 IP 192.168.1.123.1036 > 192.168.1.1.domain:  2046+[|domain]
10:37:48.031775 IP 192.168.1.1.domain > 192.168.1.123.1035:  21248 NXDomain[|domain]
10:37:48.042892 IP 192.168.1.1.domain > 192.168.1.123.1036:  2046[|domain]
10:37:48.043364 IP 192.168.1.123.1036 > 192.168.1.1.domain:  35697+[|domain]
10:37:48.058633 IP 192.168.1.1.domain > 192.168.1.123.1036:  35697[|domain]
10:37:50.014582 IP 192.168.1.88.2652 > 192.168.1.123.tftp:  17 RRQ "tftp.txt" octet
10:37:50.016505 IP 192.168.1.123.1036 > 192.168.1.1.domain:  27536+[|domain]
10:37:50.029996 IP 192.168.1.1.domain > 192.168.1.123.1036:  27536[|domain]
10:37:54.014580 IP 192.168.1.88.2652 > 192.168.1.123.tftp:  17 RRQ "tftp.txt" octet
10:37:54.016523 IP 192.168.1.123.1036 > 192.168.1.1.domain:  12633+[|domain]
10:37:54.029562 IP 192.168.1.1.domain > 192.168.1.123.1036:  12633[|domain]
10:37:54.560538 IP 192.168.1.88.netbios-dgm > 192.168.1.255.netbios-dgm: NBT UDP PACKET(138)
10:37:54.560819 IP 192.168.1.123.1036 > 192.168.1.1.domain:  9170+[|domain]
10:37:54.574808 IP 192.168.1.1.domain > 192.168.1.123.1036:  9170[|domain]
10:38:02.017838 IP 192.168.1.88.2652 > 192.168.1.123.tftp:  17 RRQ "tftp.txt" octet
10:38:02.020061 IP 192.168.1.123.1036 > 192.168.1.1.domain:  4015+[|domain]
10:38:02.032389 IP 192.168.1.1.domain > 192.168.1.123.1036:  4015[|domain]
10:38:10.017818 IP 192.168.1.88.2652 > 192.168.1.123.tftp:  17 RRQ "tftp.txt" octet
10:38:10.019684 IP 192.168.1.123.1036 > 192.168.1.1.domain:  44812+[|domain]
10:38:10.033259 IP 192.168.1.1.domain > 192.168.1.123.1036:  44812[|domain]
10:38:18.017982 IP 192.168.1.88.2652 > 192.168.1.123.tftp:  17 RRQ "tftp.txt" octet
10:38:18.019965 IP 192.168.1.123.1036 > 192.168.1.1.domain:  18230+[|domain]
10:38:18.033629 IP 192.168.1.1.domain > 192.168.1.123.1036:  18230[|domain]
10:38:26.029677 IP 192.168.1.88.2652 > 192.168.1.123.tftp:  17 RRQ "tftp.txt" octet
10:38:26.031556 IP 192.168.1.123.1036 > 192.168.1.1.domain:  12604+[|domain]
10:38:26.125255 IP 192.168.1.1.domain > 192.168.1.123.1036:  12604[|domain]



gps ~ # cat /etc/hosts.allow
#in.tftpd: 192.168.1.2/128
gps ~ # cat /etc/hosts.deny
#in.tftpd: ALL:DENY
gps ~ # cat /etc/xinetd.d/tftp
service tftp
{
        socket_type            = dgram
        protocol               = udp
        wait                   = yes
        user                   = root
        server                 = /usr/sbin/in.tftpd
        server_args            = -s /tftpboot -c
        disable                = no
        per_source             = 11
        cps                    = 100 2
        flags                  = IPv4

}
gps ~ # netstat -utlp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 *:ssh                   *:*                     LISTEN      4852/sshd
udp        0      0 *:tftp                  *:*                                 5267/xinetd
gps ~ #