There is one pcap file with two outputs, with/without the '-T tftp' option.
resp_2 resp_2_inline.pcap resp_2.out
resp_3 resp_3_malicious.pcap resp_3.out
+# TFTP tests
+tftp tftp.pcap tftp.out
+tftp-T tftp.pcap tftp-T.out -T tftp
+
# WHOIS tests
whois whois.pcap whois.out
whois-v whois.pcap whois-v.out -v
--- /dev/null
+ 1 12:31:53.718074 IP 192.168.1.2.44935 > 192.168.1.1.69: TFTP, length 14, RRQ "file1" octet
+ 2 12:31:53.732442 IP 192.168.1.1.59557 > 192.168.1.2.44935: TFTP, length 516, DATA block 1
+ 3 12:31:53.732956 IP 192.168.1.2.44935 > 192.168.1.1.59557: TFTP, length 4, ACK block 1
+ 4 12:31:53.733217 IP 192.168.1.1.59557 > 192.168.1.2.44935: TFTP, length 516, DATA block 2
+ 5 12:31:53.733497 IP 192.168.1.2.44935 > 192.168.1.1.59557: TFTP, length 4, ACK block 2
+ 6 12:31:53.733527 IP 192.168.1.1.59557 > 192.168.1.2.44935: TFTP, length 109, DATA block 3
+ 7 12:31:53.733706 IP 192.168.1.2.44935 > 192.168.1.1.59557: TFTP, length 4, ACK block 3
--- /dev/null
+ 1 12:31:53.718074 IP 192.168.1.2.44935 > 192.168.1.1.69: TFTP, length 14, RRQ "file1" octet
+ 2 12:31:53.732442 IP 192.168.1.1.59557 > 192.168.1.2.44935: UDP, length 516
+ 3 12:31:53.732956 IP 192.168.1.2.44935 > 192.168.1.1.59557: UDP, length 4
+ 4 12:31:53.733217 IP 192.168.1.1.59557 > 192.168.1.2.44935: UDP, length 516
+ 5 12:31:53.733497 IP 192.168.1.2.44935 > 192.168.1.1.59557: UDP, length 4
+ 6 12:31:53.733527 IP 192.168.1.1.59557 > 192.168.1.2.44935: UDP, length 109
+ 7 12:31:53.733706 IP 192.168.1.2.44935 > 192.168.1.1.59557: UDP, length 4