I'm not kidding when I say there can be as few as three
total packets in a TFTP file transfer, including all setup and tear down.
In a TFTP download operation,
the client sends a UDP packet to the server using destination port 69.
This is roughly equivalent to FTP's control session on TCP port 21.
The message contains either a read request or a write request using
integer operational codes of 1 or 2 respectively.
The file name being read or written is also included.
Notice I've colored the UDP source port.
Be sure to remember that number, 53346.
The server immediately starts sending data in packets using opcode 3.
The destination port is 53346, as we expect,
since this was the source port from the client's control session.
The source port from the server of 40081,
which is clearly an ephemeral port, was dynamically allocated as a data channel.
The server didn't send the file back on source port 69,
since that channel is for signaling, but used a new port.
When the client acknowledges data blocks from the server
using the opcode 4 acknowledgement message,
it does so in the data channel.
This makes sense because if there were multiple different
files transfers occurring simultaneously,
the high-numbered port numbers would allow the server to
differentiate between each transfer.
For small files,
this three-packet exchange could very well be the entire conversation.
The TFTP upload process is slightly more complex,
as it requires a minimum of 4 packets.
First,
the client sends a write request using opcode 2 and supplying the file name.
This is a signaling message, not a data transfer,
so UDP destination port 69 is used.
A random source port, 33183 in this case, is chosen by the client.
When the server responds,
it implicitly communicates the UDP port upon which it is
expecting the file upload to occur.
This is the source port of 35670,
which the client should use as its destination port for the file upload.
This message is an acknowledgement on block 0,
which is effectively saying, you may begin sending data to me.
Next, the data transfer begins.
The client uses port 35670 as its destination port to communicate
in the proper data channel to upload R3.cfg.
The same source port of 33183 is used for the opcode 3 data packet,
which carries the actual file contents.
Of course, multiple packets will be required for large files.
Once the upload is complete, the server replies with the acknowledgement,
indicating that it received the data block.
The source and destination ports are reversed.
One thing to note is just how few packets actually used UDP port
69 in both the download and upload operations.
Many engineers believe TFTP uses port 69 for the entire communication, but this is false.