PXE/TFTP Boot File Search Path

When booting a machine using (i)PXE there is simple logic the boot process will use to find the most specific boot file it can find to bootstrap from. Where the most specific one is the machine ID, and the last one called `default`. If we look on messages between the client and the TFTP server using with Wireshark, will can see it clearly.

  1. So in our example we can see that first the PXE client will look for the file `pxelinux/pxelinux.cfg/ff5f0895-5b78-e14a-b324-7874268f21f8`
  2. Then it will look for a file matching the interface MAC address `pxelinux/pxelinux.cfg/01-52-54-00-2d-e8-ec` (not sure about the 01 prefix, maybe the interface number)
  3. Then we see it is looking for file name pxelinux/pxelinux.cfg/0AB9343B, why `0AB9343B`, this is HEX prestation of the machine IP ( And each time it looks for a file which represent a wider match (by removing the last letter), when eventually it reaches 0 in our example.
  4. And finally it looks for the file called `default`

Wireshark TFTP Traffic


  1. About PXE Booting and Kickstart Technology


Leave a Reply

Your email address will not be published. Required fields are marked *