What a Month-Long TFTP Honeypot Reveals About Internet Scanners

TFTP (Trivial File Transfer Protocol) is ancient, unencrypted, and largely ignored by modern security teams. But it's still scanned relentlessly — not by botnets, but by the infosec industry itself. A developer ran a TFTP honeypot on a $5/month VPS and a home server for over a month, and the results are a fascinating look at how internet-wide scanning works.

The Numbers

Both servers saw 20–50 TFTP packets per day, almost entirely from seven known security companies: ShadowServer, Censys, Driftnet, Shodan, Palo Alto Networks, Netscout, and Internet Census. The honeypot logged Read Requests (RRQ), malformed packets, and ERROR responses — but almost no malicious exploitation.

What the Scanners Want

Most probes are simple existence checks. Requesting a file named /a or a random 8-character string can't return real data, but it confirms the server is listening. Palo Alto Networks sends two requests in quick succession — /a (netascii) then file (octet) — likely to fingerprint the server software based on how it responds to different transfer modes.

Netscout and Internet Census use similar patterns. Shodan sends bursts of non-conforming UDP payloads (e.g., 00000417271019800000000000034925) that don't follow TFTP at all — the author admits he has no idea what Shodan gains from that.

Rare but Interesting Probes

A handful of requests stand out:

• startup-config — a classic Cisco config file grab attempt
• ..\\..\\..\\..\\boot.ini — directory traversal test against Windows TFTP servers
• pxelinux.0 and various .cfg files — PXE boot configs, likely looking for exposed network boot servers
• r7tftp.txt — an nmap TFTP server identification probe

There were also a few OACK (option acknowledgment) pairs and requests for masscan-test, which seems to be a probe hiding behind the masscan scanner's name.

The Takeaway

The irony is thick: most of the traffic hitting a public TFTP port comes from security companies cataloging the internet, not from attackers trying to exploit CVEs. Only a handful of probes attempted directory traversal or config file extraction. The rest is just inventory — mapping which IPs run a TFTP server and what software they use.

If you run a TFTP server exposed to the internet (please don't), expect regular visits from these scanners. They're not malicious, but they confirm your server is visible — and visible to anyone.