TFTP traffic not showing up in wireshark using tftp filter
I have a single pcap file. If I load it in Wireshark version 3.0.5 and search for tftp traffic I get the initial read request and subsequent blocks. If I do the same thing in Wireshark version 4.2.0 I only get the initial read request. The subsequent tftp blocks show up as UDP traffic and not tftp.
As tftp uses port 69 and then subsequently changes to other dynamic ports for block transmission, I'm wondering if Wireshark 4.2.0 is only tracking port 69 and therefore looses the traffic when the port changes. Is this a bug in 4.2.0 or am I missing something? Thanks!
There is a sample capture on the Wireshark Wiki:
Works ok for me in 4.2.0 (Version 4.2.0 (v4.2.0-0-g54eedfc63953)). What do you see?
The tftp_rrq.pcap does work in my 4.2.0 version. Apparently there is an issue with my pcap that is preventing the blocks from showing up as tftp.
If you like, share a capture file (The Wireshark Q&A trace file sharing tutorial) and update the question with a link to it.
Comparing the tftp packets in my pcap to the packet on the wiki I do notice that my pcap has the tftp types as netascii and the wiki types as octet. Maybe these different types are causing my issue.