Odd packet captured during a TFTP transfer

asked 2018-01-23 15:59:11 +0000

I have a weird packets showing up during a routine TFTP transfer. These packets do not seem to be causing any issue with the transfer (afaik), however I am stumped on what could be causing them. The packet seems to start out as a valid packet, sometimes even with a valid destination MAC, but often times, by the time it reaches the source MAC, things seem to be overwritten by (byte)0x34 for the rest of the message. I'm guessing the packet is originating from my TFTP server, as the first few bytes of the source MAC (when visible) seem to correspond to that hardware address. I cannot attach images showing this packet due to point limitations but a hex dump is shown below for two instances of this packet.


0000 00 50 b6 0a b7 1e 00 3b 34 34 34 34 34 34 34 34

0010 34 34 34 34


0000 30 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34

0010 34 34 34


It also might be good to know that this is a closed LAN with only a TFTP server, TFTP client(x2), hub, and capture device. The TFTP server is using code that I wrote which uses .NET sockets. The sockets are UDP, and due to .NET socket limitations the data link layer is not accessible or modifiable (but is somehow getting modified). Any thoughts on how/why I can troubleshoot this issue would be appreciated. Thanks in advance!

edit retag flag offensive close merge delete