TFTP: Trivial File Transfer Protocol
TFTP (Trivial File Transfer Protocol, RFC 1350) is a simple, lightweight file transfer protocol using UDP port 69. 'Trivial' is accurate — TFTP has no authentication, no directory listing, no encryption, and no error recovery beyond a stop-and-wait acknowledgment per block. It can only read or write files if you know the exact filename.
TFTP is the standard protocol for transferring IOS images and configuration files on network devices. It's simple enough to be implemented in ROM bootstrap code — devices can TFTP-boot an IOS image from a server before any OS is loaded. This is the primary use case that keeps TFTP relevant despite its limitations.
TFTP uses UDP port 69 for the initial connection request. After the connection is established, the server uses a random ephemeral port for the data transfer. TFTP uses a stop-and-wait protocol: the sender transmits one block (512 bytes by default), then waits for an ACK before sending the next. This is simple but slow for large files over high-latency links.
TFTP security: no authentication means any host that can reach the TFTP server can read or write files (subject to server ACL configuration). TFTP servers should be on a management network accessible only to trusted devices. Never run a TFTP server on a public-facing network.
FTP: File Transfer Protocol
FTP (File Transfer Protocol, RFC 959) is a full-featured file transfer protocol using TCP for reliable delivery. FTP uses two connections: a control connection (TCP port 21) for commands and responses, and a data connection (TCP port 20 in active mode, or a negotiated port in passive mode) for file transfer.
FTP supports authentication (username and password), directory listing, file renaming, deletion, and permission management — features TFTP lacks entirely. However, standard FTP transmits credentials and data in plaintext. FTPS (FTP Secure) adds TLS encryption to FTP. SFTP (SSH File Transfer Protocol) is a completely different protocol that runs over SSH — despite the similar name, it shares no code with FTP.
Active vs passive FTP: in active mode, the client tells the server which port to connect back to for data (the server initiates the data connection). In passive mode, the server tells the client which port to connect to (the client initiates both connections). Passive mode is required when the client is behind NAT or a firewall that blocks incoming connections — which is almost always.
For Cisco IOS, FTP is used when you need authentication or when the file is too large for reliable TFTP transfer. IOS supports both FTP and TFTP for copying images and configurations.
IOS file management commands
The IOS `copy` command is the primary tool for file operations: `copy <source> <destination>`. Sources and destinations can be: `flash:` (device flash storage), `tftp:` (TFTP server), `ftp:` (FTP server), `running-config` (active configuration), `startup-config` (saved configuration), `nvram:` (non-volatile RAM where startup-config lives).
Common operations: backup the running config to TFTP: `copy running-config tftp:` — the IOS prompts for the TFTP server IP and filename. Restore a config from TFTP: `copy tftp: running-config`. Copy an IOS image from TFTP to flash: `copy tftp: flash:`. Copy the running config to startup-config (save): `copy running-config startup-config` (equivalent to `write memory` or `wr`).
Verify flash contents with `show flash:` (or `dir flash:`). Check available flash space before copying a new IOS image — the new image and the old image may need to coexist during verification. Delete old images with `delete flash:<filename>` and then `squeeze flash:` to reclaim space.
`show version` displays the currently running IOS image name, version, and flash filename. This is the first command to run when verifying which IOS version is active after an upgrade.
SCP and HTTPS alternatives
SCP (Secure Copy Protocol) transfers files over SSH, providing authentication and encryption that TFTP and plain FTP lack. Cisco IOS supports SCP with `ip scp server enable`. `copy scp: flash:` or `copy flash: scp:` work similarly to TFTP/FTP copies but with SSH security.
Cisco devices also support HTTPS-based file transfers via the web UI and, in newer IOS-XE versions, REST API-based configuration management — increasingly replacing manual TFTP/FTP workflows. For CCNA, TFTP and FTP are the primary exam focus, with SCP mentioned as the secure alternative.