Discussion: TFTP is a curious protocol that doesn't use authentication and is often used to transfer configuration files between an administrator's computer and switch or router.
The admin's computer would have the TFTP server software installed on it and he would
SSH into the router and run a command that instructs the router to get its configuration from a TFTP server like this:
#copy running-config tftp
The router would request the IP or name of the host from where to get the config and the name of the config file. It would then be copied down into the running-config (RAM) on the router.
This is how wireshark could have seen the file transfer.
It is advisable that you use a more secure means to transfer router configuration files because of their sensitive nature. SCP or Secure Copy can be used on most mainstream routing and switching devices.
The following answers are incorrect:
- SFTP: This isn't correct because SFTP uses TCP and is on port 22.
- FTP: This is not the right answer because FTP uses TCP and ordinarily uses ports 20/21.
- SCP: Good guess but SCP doesn't use UDP or port 69 and even if you did 'see' a file transfer between SCP hosts you wouldn't see the contents of the packets because they're encrypted. Sorry. Here's more about SCP.
The following reference(s) was used to create this question:
2013. Official Security+ Curriculum.
TFTP