Copy running-config sent multiple times on (T)FTP

mvdomburg · ‎12-19-2008

Hi all,

I am analysing IP traffic between a Network Management System (=> Spectrum) and a Cisco 1240 Access Point, which has IOS version 12.4. Where the focus currently is at restoring a running-config from the NMS to the Cisco device.

I issued commands like

copy ftp://192.168.1.1/config.txt running-config

or

copy tftp://192.168.1.1/config.txt running-config

both in Telnet and SSH on the Cisco device.

While using a packet sniffer like Wireshark, I noticed the config file has been sent more than 1 time (of which the config data can be seen in the packets). To be exactly;

For tftp - 2 times

For ftp - 4 times

Does anyone have any idea why the file has been sent multiple times?

The 'problem' also occurs while copying from ftp / tftp to a file on flash.

Thanks in advance!

Yours sincerely,

Mark

Richard Burts · ‎12-19-2008

Mark

I believe that Cisco's implementation of TFTP client in IOS has a mechanism to check accessibility when the copy is from the server to the client/IOS. The IOS sends the first get request to the server and waits for a response. This is to check that there is IP connectivity to the server, to check that the TFTP service is running on the specified address, to check that the specified file does exist in the directory where the server is processing and that there is read access to the file on the server. If IOS receives no response or receives an error response then it knows that there will not be a successful transmission and does not prepare to process the received file. If IOS receives a response indicating that data will be transmitted then it knows that there should be a successful transmission of data and cancels the first request, does whatever processing it needs to do to prepare for the transmission, and sends another get request for the file, which results in a complete transmission of the file.

If you check your wireshark captures I think that you will find that the first transmission is not complete (has fewer packets) while the second transmission is complete (has more packets).

I am not as sure why FTP would do 4 transmissions but I suspect it is simmilar to the processing of TFTP, doing an initial request to verify that data will be successful in transmission.

HTH

Rick

HTH

Rick

mvdomburg · ‎12-22-2008

Hi Rick,

Thank you for your response, I am a bit further on the subject.

While sending a 4 MB file to the device, not all 4 MB is being sent.

For the 4 runs in ftp (1460 bytes/packet):

1: 9 packets

2: 5 packets

3: 9 packets

4: the full file

TFTP is also doing 4 runs now (512 bytes/block):

1: 9 blocks

2: 3 blocks

3: 9 blocks

4: full file

Thanks for the help!

Yours sincerely,

Mark