tftpd starts randomly

Posted by Mutant on Super User See other posts from Super User or by Mutant
Published on 2012-11-26T16:47:48Z Indexed on 2012/11/26 17:08 UTC
Read the original article Hit count: 229

Filed under:
|
|

A few days ago my Little Snitch filter starts popping up tftpd. I'd never seen this before, so I immediately start freaking out thinking my Mac has been compromised. I can't find anything unusual on the system.

screen shot

The process usually dies before I can trace it (little snitch never allowed the connection just left the popup up). I finally caught it once, and found this:

[10:32]: sudo lsof -nlP | fgrep tftp
Password:
tftpd     1924 18446744  cwd       DIR                1,3      1326         2 /
tftpd     1924 18446744  txt       REG                1,3     29856 163979456 /usr/libexec/tftpd
tftpd     1924 18446744  txt       REG                1,3    600576 163686622 /usr/lib/dyld
tftpd     1924 18446744  txt       REG                1,3 303300608 189014898 /private/var/db/dyld/dyld_shared_cache_x86_64
tftpd     1924 18446744    0u     IPv4 0x34a76100fcbb06e3       0t0       UDP *:55818
tftpd     1924 18446744    2u     IPv4 0x34a76100f1113c53       0t0       UDP *:69

[10:32]: ps ax | fgrep 1924
1924   ??  S      0:00.00 /usr/libexec/tftpd -i /private/tftpboot
1949 s000  S+     0:00.00 fgrep 1924

For the life of me I can't figure out what is starting this. Nothing in cron, launchdaemons, etc. Google searches haven't yielded much either. The connection IP is different each time.

So my question is: Has anyone seen anything like this before?

© Super User or respective owner

Related posts about osx

Related posts about mac