How to restart tftpd

[Joseph Bague]

Good day,

After scanning the open ports of my A Class server (HP-UX 11i) using nmap, the tftpd process start to hog the cpu time. How can i restart this process? I tried to restart the inetd but nothing happens. Is there any patches to eliminate this? (after nmaping)

Tnxs in advance
Joseph

[Fragon]

How about this:
#/sbin/init.d/inetd stop
#/sbin/init.d/inetd start

Good luck!

[Sridhar Bhaskarla]

Hi Joseph,

tftpd is started by inetd. If you already have a tftpd running means, there is a tftp client session alive. Find it out by looking at /var/adm/syslog/syslog.log file if you enabled connection logging for inetd.

If you are sure this tftpd is not in use, then you can simply kill it.

If you don't use tftp on the box, comment it out in inetd.conf and restart inetd.

-Sri

[A. Clay Stephenson]

This is normal behavior. If you have tfpd configured in /etc/inetd.conf and inetd is running then tfppd should not be running until inetd receives a connection request from a tftp client.

[Jeff Schussele]

Hi Joseph,

You need to check whether something is actually using the tftp port - udp/69.
Do the following:

netstat -an | grep 69

If there are sockets in use then I'd recommend using lsof to see just what the heck they're doing.

lsof -i UDP:tftp
or
lsof -i udp:69

HTH,
Jeff

[Joseph Bague]

Is it safe to kill the process? Seems theres no one using this service.

Jeff, I try to lsof but give me a command not found error, I think I dont have this tool on my system, where can I download it.

Many thanks to all :)
Joseph

[Steven E. Protter]

If nobody is using it you can remove it from inetd

Here is a step by step procedure.

vi /etc/inetd.conf

find the line that includes tftpd

comment it out by placing a # at the beginning of the line.

save the file

inetd -c

reloads inetd.

Now there is no tfptd daemon running.

SEP

[Sridhar Bhaskarla · Accepted solution]

Hi,

lsof is actually going to find the process "tftpd" that is using the port 69. You can check the client's IP address by actually looking at netstat -an as suggested by Jeff. You will see your host:69 as source with xxxxx:arbitrary_port as destination. Your xxxxx is the remote system.

I believe your nmap might have connected to your tftpd port and left it in Close_Wait state. Your netstat -an will show that information.

Just go ahead and kill it in that case.

-Sri

[yogesh_4]

I feel in the normal senario there is not need that tftp should run. If you are not using it then you can comment it out in /etc/inetd.conf. Also after doing changes you have to restart the inetd by #/sbin/init.d/inetd stop and #/sbin/init.d/inetd stop commands. Hopt this will solve your problem

[Con O'Kelly]

A minor pint regarding removing tftp from inetd.conf. I would be careful commenting this out of inetd.conf if you are using an Ignite-UX server as it is used by Ignite for network installs.

Joeseph - lsof does not come with HP-UX. You can download it from the following site (search for lsof).
http://hpux.cs.utah.edu/

Cheers
Con