69

Port 69/tcp is registered with IANA as tftp with the description "Trivial File Transfer," assignee and contact [David_Clark], and a blank reference field — the assignment covers both 69/tcp and 69/udp under the same service name. The protocol it names, the Trivial File Transfer Protocol (RFC 1350, July 1992), is a deliberately minimal, lockstep file-transfer protocol with no authentication, no encryption, and no directory listing; option extensions came later (RFC 2347–2349, May 1998: blksize, tsize, timeout) and RFC 7440 (January 2015) added a windowing option for throughput. The important nuance for an analyst is the TCP/UDP split: every standard TFTP implementation and every TFTP RFC operates exclusively over UDP, so the 69/tcp registration is a historical dual-listing that carries no legitimate traffic in practice — observed TCP/69 activity is anomalous and worth treating as a misconfiguration, a scanner probe, or malware rather than a normal service. TFTP itself (over UDP) is the workhorse of LAN bootstrapping: PXE/diskless network boot, firmware and config delivery to routers, switches, firewalls and IP phones, and OS-image staging in deployment systems (Microsoft WDS, iPXE/PXELINUX, FOG, OpenStack Ironic; daemons include atftpd and dnsmasq on Linux and TFTPD32/64 on Windows). Because the protocol has no access controls, exposed servers are a recurring external-assessment finding, and multiple implementations have shipped serious bugs — directory-traversal flaws that read files outside the TFTP root via .. sequences (e.g. CVE-2004-0788, CVE-2018-14882), buffer overflows leading to remote code execution (CVE-2020-11878 in TFTPD32/64, critical; CVE-2010-4652 in NetBSD), arbitrary code execution (CVE-2017-14205 in SolarWinds TFTP), and arbitrary file overwrite (CVE-2008-5628). TFTP has also been abused as a payload-drop channel by worms (the Blaster worm pulled its payload over TFTP). The practical posture: block TCP+UDP 69 at the perimeter, restrict by source IP on internal segments, and confine the TFTP root to an isolated directory; a responsive 69/tcp specifically should be treated as suspicious.

IANA assignment

tftp — "Trivial File Transfer"; reference (blank — no RFC cited in IANA registry); assignee/contact [David_Clark]; dual-registered 69/tcp + 69/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry)

Range class

well-known (0–1023) [Confirmed]

Related ports

PXE-boot cluster — 67/68 (DHCP), 4011 (proxyDHCP); contrast 21 (FTP), 22 (SFTP/SSH)

Primary use

Trivial File Transfer Protocol (RFC 1350) — minimal UDP file transfer for LAN bootstrapping: PXE/diskless network boot, firmware/config delivery to network appliances and IP phones, OS-image staging

Common software

TFTPD32/TFTPD64, SolarWinds TFTP Server, haneWIN TFTP, atftpd, dnsmasq (Linux); Microsoft WDS, iPXE/PXELINUX, FOG Project, OpenStack Ironic

Security implications

no authentication, no encryption, no access controls — cleartext, any reachable host can read/write; directory-traversal, boot-image injection in PXE environments, and malware-delivery abuse are documented risks; exposed servers are a common external-assessment finding

Notable CVEs

CVE-2020-11878 (TFTPD32/64 stack overflow, RCE, critical); CVE-2017-14205 (SolarWinds, arbitrary code execution); CVE-2019-12904 (haneWIN, directory traversal); CVE-2018-14882 (D-Link, directory traversal); CVE-2010-4652 (NetBSD, buffer overflow); CVE-2008-5628 (arbitrary file overwrite); CVE-2004-0788 (generic .. traversal)

Protocol references

RFC 1350 (current standard); RFC 2347–2349 (option extensions); RFC 7440 (windowing); RFC 6335 (IANA port-registry procedures)

Typically seen on (UDP)

network-boot servers, deployment/imaging infrastructure, managed network appliances on internal segments; a responsive 69/tcp specifically is anomalous

TCP vs UDP

TFTP operates exclusively over UDP in every standard implementation and RFC; 69/tcp is a historical IANA dual-listing with no RFC and no mainstream implementation. TCP/69 traffic in the wild is anomalous — misconfiguration, scanner probe, or malware

[Likely] — IANA registry, Cisco community discussion (single corroborating community thread)

Analyst note

For 69/tcp treat any open/responsive port as suspicious — TFTP is UDP-only in practice; for 69/udp, an exposed unauthenticated TFTP server is a high-value finding.

Port 69/udp carries the Trivial File Transfer Protocol, a deliberately minimal UDP-based file-transfer mechanism with no authentication, used for PXE/network boot, loading firmware and configuration onto routers and switches, and provisioning IP phones. A transfer begins with a Read Request (RRQ) or Write Request (WRQ) to port 69; data then flows in fixed 512-byte blocks (unless a larger blocksize is negotiated), each acknowledged in lock-step before the next is sent, and only the first packet of a transaction uses port 69 while the rest move over ephemeral ports. There is no directory listing, rename, delete, or any authentication — the protocol trades capability for a tiny code footprint that fits in boot ROMs. The IANA registry lists tftp with a blank Reference field and attributes the assignment to David Clark; RFC 1350 (STD 33) is the governing protocol spec but is not the IANA-cited reference, and option extensions live in RFC 2347/2348/2349 with windowing added by RFC 7440. The security posture is stark: with no authentication or encryption, any reachable client can read (and, where permitted, write) files, which is why TFTP has historically been abused to exfiltrate or push device configs and why the Blaster worm used a TFTP GET to fetch its payload. As a UDP service it also carries reflection/amplification potential. For an analyst, an open 69/udp usually signals a network-boot/provisioning server or device-management host; during triage, attempt to retrieve common filenames (startup-config, pxelinux.cfg/default) to gauge exposure and confirm it is not reachable from untrusted networks. TFTP should never be internet-exposed.

IANA assignment

tftp — "Trivial File Transfer"; reference (blank — no RFC cited in IANA registry); assignee/contact David Clark; governing protocol RFC 1350 / STD 33 (not the IANA-cited reference) [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

a common infrastructure UDP port (PXE/boot/provisioning) but not assigned a precise nmap-services open-frequency comparable to TCP ports (UDP scanning is sparser) [Well-established] — nmap-services file

Related ports

21 FTP (TCP, authenticated) as the heavier sibling; 67/68 DHCP and 4011 (PXE/BINL) in network-boot environments

Primary use

unauthenticated UDP file transfer for PXE/network boot, device firmware/config loading, IP-phone provisioning

Other/unofficial uses

ad-hoc small-file transfer on trusted LAN segments [Community-reported]

Security implications

no authentication/encryption — readable/writable file exposure; historically abused for config exfiltration and worm payload delivery (Blaster used TFTP GET on 69); UDP reflection/amplification potential; never internet-expose

Typically seen on

PXE/boot servers, router/switch management hosts, IP-phone provisioning servers, network-device firmware servers

Analyst note

Open 69/udp usually signals a network-boot/provisioning or device-management host. Attempt to fetch common filenames (startup-config, pxelinux.cfg/default) to gauge exposure, and confirm it is not reachable from untrusted networks.