Port / UDP
69TFTP
TFTP is a minimal file transfer protocol used for PXE boot images, switch firmware, and appliance provisioning.
If it is internet-facing: Finding 69 open to the internet is a finding in its own right — it warrants an explanation, not just a rule.
Exposure
Trusted network only
Transport
Cleartext
Risk if public
High
Exposure verdict
Port 69 belongs on a trusted internal network. If a perimeter scan finds it answering, treat that as a firewall defect rather than a configuration preference.
Traffic crosses the network readable and modifiable. Anything sensitive on this port needs a tunnel, a VPN, or a different protocol.
Assigned by IANA through a review process. On Unix systems a process needs root or the CAP_NET_BIND_SERVICE capability to bind here, which is why containers so often remap these to a higher port.
Grouped with the other file transfer & shares ports so a rule written for one can be checked against its neighbours.
What actually goes wrong
2 notes- There is no authentication at all — anyone who can reach the port can read or write the served directory.
- Configuration backups pushed to TFTP frequently contain device credentials in cleartext.
Recommended firewall rule
Allow only from 10.0.0.0/8, drop the rest
Swap in the CIDR your administrators or application tier actually come from — the point is that the default answer is no.
ufw
sudo ufw allow from 10.0.0.0/8 to any port 69 proto udpiptables
sudo iptables -A INPUT -p udp -s 10.0.0.0/8 --dport 69 -j ACCEPT
sudo iptables -A INPUT -p udp --dport 69 -j DROPIf you do need it open to everyone
sudo ufw allow 69/udpWrite down why. An unexplained allow rule outlives the person who added it, and the next reviewer has no way to tell a deliberate exception from an accident.
Check what is really there
Listening locally
sudo ss -ulpn 'sport = :69'The bind address is the answer that matters: 127.0.0.1 is local-only, 0.0.0.0 and :: mean every interface.
Listening (macOS)
sudo lsof -nP -iUDP:69macOS ships lsof rather than ss; this names the owning process and user.
From outside
nmap -sUV -Pn -p 69 <host>A version probe confirms whether TFTP is actually what answers, rather than trusting the number. Only scan hosts you are authorised to test.
Reachability
nc -vzu <host> 69The quick yes/no when you only need to know whether a path exists through the firewall.
The safer path
port 22Move to port 22 — SSH / SFTP
SSH / SFTP does the same job with the session protected from the first byte, so there is no plaintext phase for an on-path attacker to read or strip. Migrating is usually a client configuration change plus a firewall swap.