.netsocketswiresharktftp

Benign but malformed packet showing up during TFTP transfer


I have, what looks to be, malformed packets showing up during a routine TFTP transfer. These packets do not seem to be causing any issue with the transfer as all data is received and later hashed to a correct value, however I am stumped on what could be causing them. The packet seems to start out as a valid packet, sometimes even with a valid destination MAC, but often times, by the time it reaches the source MAC, things seem to be overwritten by (byte)0x34 for the rest of the message. I'm guessing the packet is originating from my TFTP server, as the first few bytes of the source MAC (when visible) seem to correspond to that hardware address. Shown below are screen-grabs showing two instances of this malformed packet. Malformed Packet1 Malformed Packet2 It also might be good to know that this is a closed LAN with only a TFTP server, TFTP client(x2), hub, and capture device. The TFTP server is using code that I wrote which uses .NET sockets. The sockets are UDP, and due to .NET socket limitations the data link layer is not accessible or modifiable (but is somehow getting modified). Any thoughts on how/why I can troubleshoot this issue would be appreciated. Thanks in advance!


Solution

  • So after a bit of troubleshooting it looks as if the problem was originating from a buffer overflow in wireshark on the MITM computer, the packets never truly "existed" on the network so neither the TFTP host nor client interacted with them (hence this problem being benign). By upping the buffer size in wireshark this problem was alleviated.