Common attacks and weaknesses
- Anyone can download configuration files (with passwords) or upload files.
Port 69: TFTP
Trivial file transfer without authentication, used for network boot and device configs.
69
How TFTP works
File transfer & sharingFiles are sent over port 69 in pieces and reassembled on the other side. It travels in clear text: anyone on the path can read it, passwords included.
- Transport
- UDP · TCP
- Exposure risk
- 7/10 high if reachable from the Internet
- Encryption
- Clear textreadable on the network
- IANA status
- Assigned1 registered service
- Range
- Well-known (0-1023)
- Category
- File transfer & sharing
Is port 69 dangerous?
How to secure it
- Restrict to the provisioning network and make the root read-only.
IANA registry entries for port 69
| Service | Port | Transport | Description | Reference | Updated |
|---|---|---|---|---|---|
| tftp | 69 | TCP, UDP | Trivial File Transfer | - | - |
// source: IANA service name and port number registry
Which program uses port 69, and is it reachable?
Linux
sudo ss -ltnup 'sport = :69' # process listening on 69
sudo lsof -nP -i :69macOS
sudo lsof -nP -i :69
Windows (PowerShell)
Get-NetTCPConnection -LocalPort 69 -State Listen | Select LocalAddress, OwningProcess Get-NetUDPEndpoint -LocalPort 69 netstat -ano | findstr :69
From another machine
nmap -p 69 -sV <host> sudo nmap -sU -p 69 <host> nc -zv <host> 69
Block it in the firewall
sudo ufw deny 69/tcp # Linux (ufw) New-NetFirewallRule -DisplayName "Block 69" -Direction Inbound -LocalPort 69 -Protocol TCP -Action Block # Windows
What is port 69 used for?
Trivial file transfer without authentication, used for network boot and device configs.
Is port 69 TCP or UDP?
Port 69 is registered for UDP and TCP. In practice the service mostly uses UDP.
Is it safe to open port 69?
It is rated 7/10 (high) when exposed to the Internet. Anyone can download configuration files (with passwords) or upload files. Restrict to the provisioning network and make the root read-only.
How do I check if port 69 is open?
On Linux run "ss -ltnup 'sport = :69'", on macOS "lsof -nP -i :69", and on Windows "netstat -ano | findstr :69" to see the local process. From another machine, "nmap -p 69 <host>" shows whether it is reachable.
Other file transfer & sharing ports
:445 SMB tcp · udp · critical risk :21 FTP tcp · udp · sctp · high risk :139 NetBIOS Session tcp · udp · high risk :2049 NFS tcp · udp · sctp · high risk :873 rsync tcp · udp · high risk :20 File Transfer [Default Data] tcp · udp · sctp :115 Simple File Transfer Protocol tcp · udp :152 Background File Transfer Program tcp · udp