[Nitin Shrivastav <n_shrivastav78@xxxxxxxxx>]

Hello,

I am trying to understand how does ethereal identifies
tftp data packets. I am running ethereal on the server
machine. When i initiate the tftp transfer from
clinet, my client uses a local udp port number 'x' and
dest port is well defined tftp port 69.

Now server responds back with a local udp source port
'y'destined to port 'x'. Subsequently, all the data
transfer happens using these two ports. On capturing
the packets in ethereal, it correctly identifies all
the data packets as belonging to a tftp connection.

The question is how does ethereal identifies this.
Does it mark the original client port number 'x' in
the first request packet to identify all the
subsequent packets with source port 'x' as belonging
to tftp..?

Thanks for your help,
Nitin


__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com