Ask Your Question
0

TFTP packet size and MTU

asked 2020-08-08 13:24:29 +0000

juvt gravatar image

updated 2020-08-08 13:29:41 +0000

Hi,

I'm using TFTP protocol on two PCs (one client and one server) to send some files. WireShark used to capture the packets. TFTP protocol default packet size is 512 bytes. However, TFTP has the option to send in different packet sizes.

Logically, the higher the packet size the less number of packets required to send a file. This is true when I try 128, 512, 1024 and 1428 bytes options. However, when I go for 2048, 4096, till 32768 bytes options, this logic is no longer applicable and I observe the following in WireShark:

  • Packets size is not equal to the specified option. for example: for 2048 bytes option, packet size= 614 bytes !!
  • Less number of packets required to send a file even though packet size is much less.
  • The file transferring is much faster.
  • File sent is complete and no corruption on file.

I couldn't understand what is going on. Does this has to do with max. frame size or MTU? because MTU for Ethernet is around 1518 bytes. What make me confused more is even that the packet size is much less, the packets numbers are going down when I go for higher byte options and the file transfer is faster and every thing is perfect.

Attached is an example for sending an 438KB picture in different packet size options (Bloke size). Notice the "weird relation" in terms of packet length and the number of packets sent when the "block size" = 2048 bytes or higher.

So, anyone could explain to me the logic here?

edit retag flag offensive close merge delete

Comments

Is is often the case, attempting to diagnose issues with a screenshot is difficult because important information elsewhere in the capture isn't visible. Can you upload the captures to the same location?

grahamb gravatar imagegrahamb ( 2020-08-08 14:17:20 +0000 )edit

sure, I've upload wireshark file for all transfer options. just select tftp in filter box.

juvt gravatar imagejuvt ( 2020-08-08 14:52:21 +0000 )edit

Oh, no. The problem is that I always apply display filter "TFTP". when I remove the filter, I can see multiple fragmented packets sent.

juvt gravatar imagejuvt ( 2020-08-08 15:01:43 +0000 )edit

Use data.len as the column rather than frame.len to see the reassembled length.

grahamb gravatar imagegrahamb ( 2020-08-08 18:57:06 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted
1

answered 2020-08-09 08:08:37 +0000

Guy Harris gravatar image

updated 2020-08-09 11:12:16 +0000

grahamb gravatar image

Logically, the higher the packet size the less number of packets required to send a file. This is true when I try 128, 512, 1024 and 1428 bytes options. However, when I go for 2048, 4096, till 32768 bytes options, this logic is no longer applicable and I observe the following in WireShark:

TFTP runs over UDP, and a single UDP packet is sent as a single IP packet.

If the IP packet is too big to be sent in a single link-layer packet, the sending IP layer "fragments" it into smaller packets, each of which can be sent in a single link-layer packet, and the receiving IP layer must reassemble all the fragments of the original IP packet and provide that to the receiving UDP layer. UDP has no mechanism to handle this itself, unlike TCP, which divides the stream of data provided to it into "segments", each of which can be made small enough to fit in a single link-layer packet.

The maximum size of a raw Ethernet packet, without counting the FCS (which is usually not captured by Wireshark, so it won't show up in the packet or in the frame length) is 1514 bytes; that's 14 bytes of Ethernet header (destination address, source address, type/length), and 1500 bytes of payload.

A TFTP data packet sending 1024 bytes of data, sent as an IPv4 packet over Ethernet, and with no IP options, will have 14 bytes of Ethernet header, 20 bytes of IPv4 header, 8 bytes of UDP header, 4 bytes of TFTP header, and 1024 bytes of data, for a total of 1070 bytes, which is <= 1514, so that can be sent in an un-fragmented IPv4 packet.

A TFTP data packet sending 1428 bytes of data, sent as an IPv4 packet over Ethernet, and with no IP options, will have 14 bytes of Ethernet header, 20 bytes of IPv4 header, 8 bytes of UDP header, 4 bytes of TFTP header, and 1428 bytes of data, for a total of 1474 bytes, which is <= 1514, so that can be sent in an un-fragmented IPv4 packet.

A TFTP data packet containing 2048 bytes of data, sent as an IPv4 packet over Ethernet, and with no IP options, will have 14 bytes of Ethernet header, 20 bytes of IPv4 header, 8 bytes of UDP header, 4 bytes of TFTP header, and 2048 bytes of data, for a total of 2094 bytes, which is > 1514, and which thus would have to be sent as more than one fragment of a fragmented IPv4 packet.

Packets size is not equal to the specified option. for example: for 2048 bytes option, packet size= 614 bytes !!

The first fragment will probably be the maximum size, with 14 bytes of Ethernet header, 20 bytes of IPv4 header, 8 bytes of UDP header, 4 bytes of TFTP header, and 1468 bytes of data and the second fragment will contain the remaining 2048 - 1468 = 580 bytes of data; it does not ... (more)

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2020-08-08 13:24:29 +0000

Seen: 111 times

Last updated: Aug 09