"tftp: SEND error:1, msg: File not found" Message in Procurve 5308xl Log

[Gauler]

This Message is in the Log every 30 Minutes, what is it? I don't want the switch to SEND something....
Chris

[Ron Kinner]

Not sure what exactly is going on. I do know that the procurve will try to get its config from a TFTP server at start up. Did you run it through the Switch Setup?Perhaps all it needs is for you to assign it an IP address and save the configuration?

Appears to use the cisco IOS so you can get to the command line and do

show config
or
show run

and see if there is anything in there about a TFTP server.

On a cisco if you type a ? after a command it will tell you if there are any options:

show tftp ?

or just

show ?

If all else fails get yourself a tftp server (3Com's is good and free) and set it up and tell the switch about it and see if you get any files.

Ron

[Louis Goeppinger]

Hello Chris,
The alert ???tftp: SENT error:1, msg: File not found??? is referring to a tftp server on the network that is requesting a file from the switches. The file being requested is not on the switch, so the error is generated. You will need to find the tftp server and stop the requests at the server to stop the errors from continuing to be logged.
Louis

[Gauler]

Any Ideas how I can find a tftp Server in my Network? I have no ideas....

Chris

[Arimo Laine_2]

Hi.

Contrary to what's been said I have no information that the switch would by default try to connect to TFTP in any way. Neither is it capable of doing anything with TFTP automatically.

As for where to find the TFTP server... it's sitting in one of your computers, whether a server or a workstation I don't know.

You maybe could find it by configuring a monitoring port on the switch, capturing all network traffic for an hour and try to find which IP address is sending TFTP requests to the switch.

HTH,
TAL

[Louis Goeppinger]

Hi Chris,
A packet sniffer would probably be the fastest way to find the TFTP server address
Louis

[Ron Kinner]

Arimo,

ftp://ftp.hp.com/pub/networking/software/59692354.pdf

Page 5-11 under DHCP/BOOTP Operation. It says that roughly that if given a TFTP server address by DHCP/BOOTP it would automatically try to get a config from the TFTP server. I was just thinking it might have gotten an address by accident. I know a lot of devices will keep trying to get a DHCP address periodically unless you give them an IP address so I thought it was worth a try. Seems odd that there would be a rogue TFTP Server on the network.

Gauler:

As for how to find a TFTP server on your network:

Go to www.shareware.com or www.winsite.com and search for "port scanner" and you will find a bunch of them. Download one and it should do the job for you. Most of them allow you to set the network range to scan and which service to look for. TFTP Service runs on port 69.

Ron

[Gauler]

Thanks for the answers, I have not configured dhcp or bootp, I have enter the IP-Adress manual. (Hope, I understood your answer correct, my english...)
A Portscanner runs over the hole Network but didn't find any tftp-Server. It seems that I must do a log of the hole traffic....

The only maschines with tftp can be the 10 servers, the other does't runs the whole day, but there is no tftp server on these servers. Can it be any error in the configuration file?

[Arimo Laine_2]

Thanks Ron.

I checked the manual and it does talk about TFTP. The way I read it is that the DHCP server provides the TFTP server address to the switch, so if DHCP in this case is not used, this doesn't apply.

Chris, it just came to me that the switch actually works itself as a TFTP server. This error would appear, if you have a TFTP client trying to retrieve a file from the switch.

So, I think that's actually the thing you should be looking for, a TFTP GET request directed TO the switch instead of FROM the switch.

As for where to find the TFTP bugging you, I'd propably take first a close look on all UNIX/LINUX boxes in the network, then maybe if you have other networking devices, 3Com or Cisco.

HTH, Arimo

[Ernst, Manfred]

Hi Gauler,

I have the same error messages with my HP switches and I would like to know if you found a solution for this problem. Did you find a client that talks to the switch using tftp?

Manfred Ernst

[Gauler]

No I have not solved the Problem yet, not enough time to work on it at this time, maybe later, I have used a portscanner to locate the tftp server in the network but the switch is a router and i will not scan every network becaue I need a pc in every network...
Any Ideas to find the pc faster?

[Arimo Laine_2]

Hi

You can also set one of the switch ports to act as a monitor port and connect a sniffer PC directly there. Then all traffic passing to and from the ports you want to monitor will be duplicated to the monitor port. You can monitor one port at a time or several at the same time. Then you should be able to find the right direction.

Anyhow, as the switch won't send anything anyway (the only thing it has to send is the OS), this is fortunately more like a nuisance than anything else.

Arimo

[bernard goehrs]

Hi,

We had the same problem some time age; a log file full of those tftp error messages.
Even it looks like an tftp problem, it was an SNMP Problem caused by the SNMP service running on an WinNT Box. We stopped that service and .. fixed.

Bernard

[Arimo Laine_2]

Hi Bernard.

That's very interesting. Could you give more details on the environment, like windows version and service pack, switch software and the like?

Thanks,
Arimo

[Ernst, Manfred]

I found the source in our network which causes tftp traffic. It is an ELSA LANCOM ISDN Router. Every time you boot the router or start the lan capi service on a NT/2000-machine a broadcast tftp request (destination 255.255.255.255) is sent to get a file named sysinfo. This is the message that cause our switches to create the log entry.

So far so good. But now I am searching for a solution to disable these tftp requests on the ELSA lancom routers, until now without success. Background is that I activated snmp-traps on the switches and now I get a warning every time when these tftp packets are sent.

Is there anybody who can help me?

Manfred Ernst

[Ron Kinner]

You would think that once configured (and after the configuration was saved) the router would not need to go looking for a file.

Your NT/2000 boxes should also be configured. There is a configuration manager that they say should be installed. Did you install it?

I'd ask the manufacturer:

http://www2.elsa.de/internet/onlineassistent.nsf/search-keyword?OpenAgent&language=de&ProductName=ELSA+LANCOM+ADSL/ISDN&keyw=A1-ROUTER-7&escalation=0&ProdSearch=1

Click on: Bitte schildern Sie uns das Problem.

I tried but they want the serial number etc. of your product which I don't have.

Ron

[OLARU Dan]

Hi Chris.
If you installed and used HP TopTools on some workstation, then beware that this product has a tftp server. Maybe you started this tftp server from TopTools, without intent (I did just that, and now my portscanner sees tftp server on port 69).

[Rikz]

hmm Ok the last reply is 10 years ago but for all admins with the same msg in the log:

Have a look to your Virusscanner / System detector when you don´t have an tftp server in your network.
I had the same problem in my network and find out that this msg generated after the McAfee Rogou System Detection looking for unknown devices.

You need to reconfigure the RSD in McAfee ePO.

BR
Rik