Every network engineer eventually needs to move a file across the network — a new IOS image to a router, a configuration backup, a software update, or a large dataset between servers. Two of the oldest and most fundamental protocols for this job are TFTP (Trivial File Transfer Protocol) and FTP (File Transfer Protocol). Despite their age, both are still heavily used today, especially in enterprise networking for firmware/image transfers and automated backups.
This article explains what these protocols are, how they differ, when to use each, and how to actually configure and verify them using Cisco devices, Linux servers, and Python scripts.
What Is File Transfer, Fundamentally?
At its core, transferring a file over a network means breaking a file into packets, sending those packets from a source to a destination, and reassembling them correctly and in order at the other end. The protocol governs three things:
- How the connection is established (if at all).
- How data is transported (reliably or not).
- How authentication and security are handled.
TFTP and FTP answer these three questions very differently, and that difference defines when each is used.
TFTP — Trivial File Transfer Protocol
TFTP is deliberately “trivial” — a stripped-down, minimal protocol designed for simplicity and speed, not security.
Key Characteristics of TFTP
- Uses UDP port 69 (connectionless, unreliable transport).
- No authentication — no username or password.
- No directory browsing — you must know the exact filename.
- Very small code footprint — this is why it’s built into router/switch boot firmware (ROMMON).
- Commonly used for network booting (PXE), transferring IOS images, and configuration backup/restore in a trusted, internal network.
Because TFTP has no login and travels in cleartext with no reliability guarantees, it should never be used across the open Internet or in an untrusted network segment.
Why TFTP Still Exists Today
You might wonder why anyone still uses a protocol with zero security. The answer is context: TFTP is used inside trusted, isolated management networks — for example, copying a Cisco IOS image from a TFTP server to a switch during an upgrade. Speed and simplicity matter more than security in that narrow use case, since the network segment is already physically and logically controlled.
FTP — File Transfer Protocol
FTP is a much more capable, general-purpose protocol built for real-world file management.
Key Characteristics of FTP
- Uses TCP — reliable, connection-oriented transport.
- Uses two separate connections:
- Control connection (TCP port 21) — for commands like login, list directory, delete.
- Data connection (TCP port 20 in active mode, or a negotiated port in passive mode) — for actual file transfer.
- Supports authentication (username/password).
- Supports directory listing, renaming, deleting files — full file management, not just transfer.
- Has secure variants: FTPS (FTP over SSL/TLS) and SFTP (SSH File Transfer Protocol, a completely different protocol that runs over SSH).
Active vs Passive FTP Mode
| Mode | How Data Connection Is Opened | Firewall Friendliness |
|---|---|---|
| Active | Server initiates connection back to client on a client-chosen port | Poor — client-side firewalls often block unsolicited inbound connections |
| Passive | Client initiates both connections to the server | Good — works well through NAT/firewalls |
sequenceDiagram
participant Client
participant Server
Client->>Server: TCP Connect (port 21) - Control Channel
Client->>Server: USER / PASS (login)
Server-->>Client: 230 Login successful
Client->>Server: PASV (request passive mode)
Server-->>Client: Enters passive mode, opens data port
Client->>Server: TCP Connect to data port
Client->>Server: RETR filename.txt
Server-->>Client: File data transferred
Server-->>Client: 226 Transfer completeTFTP vs FTP — Side-by-Side Comparison
| Feature | TFTP | FTP |
|---|---|---|
| Transport Protocol | UDP | TCP |
| Port(s) | 69 | 21 (control) + 20/dynamic (data) |
| Authentication | None | Username/Password |
| Reliability | None (application must handle loss) | Reliable (TCP handles retransmission) |
| Directory listing | No | Yes |
| Security | Cleartext, no encryption | Cleartext by default; FTPS/SFTP add encryption |
| Typical Use Case | IOS image transfer, PXE boot, config backup on trusted LAN | General file transfer, website uploads, backups |
| Complexity | Very simple | More complex, more features |
Configuring TFTP on a Cisco Router
Step 1: Verify Connectivity to the TFTP Server
Router# ping 192.168.1.100Step 2: Backup the Running Configuration to a TFTP Server
Router# copy running-config tftp
Address or name of remote host []? 192.168.1.100
Destination filename [router-confg]? router-backup.cfgStep 3: Upgrade an IOS Image via TFTP
Router# copy tftp flash
Address or name of remote host []? 192.168.1.100
Source filename []? c2900-universalk9-mz.SPA.157-3.M.bin
Destination filename [c2900-universalk9-mz.SPA.157-3.M.bin]?Step 4: Verify
Router# show flash
Router# dir flash:
Router# show running-config | include hostnameSetting Up a TFTP Server on Linux
sudo apt update
sudo apt install tftpd-hpa -y
# Configuration file
sudo nano /etc/default/tftpd-hpaTFTP_USERNAME="tftp"
TFTP_DIRECTORY="/srv/tftp"
TFTP_ADDRESS=":69"
TFTP_OPTIONS="--secure"sudo mkdir -p /srv/tftp
sudo chmod -R 777 /srv/tftp
sudo systemctl restart tftpd-hpa
sudo systemctl status tftpd-hpaTest the transfer from a client:
tftp 192.168.1.100
tftp> get router-backup.cfg
tftp> quitSetting Up an FTP Server on Linux (vsftpd)
sudo apt update
sudo apt install vsftpd -y
sudo nano /etc/vsftpd.confKey settings:
anonymous_enable=NO
local_enable=YES
write_enable=YES
chroot_local_user=YES
pasv_enable=YES
pasv_min_port=40000
pasv_max_port=40100sudo systemctl restart vsftpd
sudo systemctl enable vsftpdConnecting a Cisco router to an FTP server for a config backup:
Router(config)# ip ftp username admin
Router(config)# ip ftp password Cisco123!
Router# copy running-config ftp://192.168.1.100/router-backup.cfgVerifying FTP/TFTP Operations
Router# show ip ftp
Router# debug ip tftp
Router# show logging
Router# show flash: (verify file arrived and size matches)On Linux:
sudo systemctl status vsftpd
sudo journalctl -u vsftpd -f
sudo ss -tulpn | grep -E '21|69'Automating File Transfer with Python
Python’s built-in ftplib makes it easy to script FTP-based configuration backups — useful for automating nightly backups of dozens of routers.
from ftplib import FTP
def backup_config(host, user, password, local_filename, remote_filename):
ftp = FTP(host)
ftp.login(user=user, passwd=password)
with open(local_filename, "rb") as f:
ftp.storbinary(f"STOR {remote_filename}", f)
ftp.quit()
print(f"Backup {remote_filename} uploaded successfully.")
backup_config(
host="192.168.1.100",
user="admin",
password="Cisco123!",
local_filename="router1-running-config.txt",
remote_filename="router1-backup.cfg"
)
For TFTP, Python doesn’t have a built-in TFTP client, but the third-party tftpy library works well:
import tftpy
client = tftpy.TftpClient("192.168.1.100", 69)
client.download("router-backup.cfg", "local-router-backup.cfg")
print("TFTP download complete.")
Network Diagram: Typical Use Case
flowchart LR
A[Router / Switch] -- TFTP UDP:69 --> B[TFTP Server<br/>IOS Images & Configs]
C[Admin Workstation] -- FTP TCP:21/20 --> D[FTP Server<br/>General File Storage]
A -- SSH backup script --> CBest Practices
- Use TFTP only inside trusted management VLANs, never across untrusted or public networks.
- Prefer SFTP or FTPS over plain FTP whenever transferring sensitive data, since plain FTP sends credentials in cleartext.
- Always verify file integrity after transfer using
verify /md5on Cisco devices:Router# verify /md5 flash:c2900-universalk9-mz.SPA.157-3.M.bin - Restrict TFTP/FTP server access with ACLs or firewall rules — only allow specific management IPs.
- Automate configuration backups on a schedule (cron + Python script, or Cisco Kron scheduler) rather than relying on manual transfers.
- Keep enough free flash space before an IOS upgrade — check with
show flashfirst.
Troubleshooting
| Symptom | Likely Cause | Fix |
|---|---|---|
| TFTP transfer times out | UDP blocked by firewall/ACL, or wrong IP | Check ping, verify ACLs allow UDP/69 |
| “%Error opening tftp” on router | Wrong filename or file not in TFTP root directory | Confirm exact filename and case sensitivity |
| FTP login fails | Wrong credentials, or local_enable=NO in vsftpd.conf | Check config, re-enter ip ftp username/password |
| FTP passive mode fails through firewall | Passive port range not opened on firewall | Open the pasv_min_port–pasv_max_port range |
| File transfer corrupts/incomplete | UDP packet loss during TFTP (no retransmission for lost blocks beyond timeout) | Retry transfer, use FTP for unreliable links |
Flash memory full after copy tftp flash | Not enough space for new image | Delete old image with delete flash:oldimage.bin, then squeeze flash: |
Conclusion
TFTP and FTP represent two philosophies of file transfer: TFTP trades away security and reliability for absolute simplicity, making it perfect for controlled environments like firmware upgrades. FTP trades simplicity for capability — authentication, directory browsing, and reliable TCP transport — making it suitable for general-purpose file management. Understanding when to use each, and how to configure, verify, and troubleshoot them on both Cisco and Linux platforms, is a core skill for any network engineer.
References
- RFC 1350 – The TFTP Protocol (Revision 2) — https://datatracker.ietf.org/doc/html/rfc1350
- RFC 959 – File Transfer Protocol — https://datatracker.ietf.org/doc/html/rfc959
- Cisco IOS File Management Commands — https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/fundamentals/command/cf_command_ref/copy.html
- vsftpd Documentation — https://security.appspot.com/vsftpd.html
- tftpd-hpa Ubuntu Manual — https://manpages.ubuntu.com/manpages/focal/man8/in.tftpd.8.html
- Python ftplib Documentation — https://docs.python.org/3/library/ftplib.html
- tftpy PyPI Package — https://pypi.org/project/tftpy/
