$ tshark -r ubuntu-tftp.pcap -n -t ad
    1 2026-09-12 10:01:45.203039 192.168.100.20 → 192.168.100.10 TFTP 63 Read Request, File: hello.txt, Transfer type: netascii
    2 2026-09-12 10:01:45.209098 192.168.100.10 → 192.168.100.20 TFTP 74 Data Packet, Block: 1 (last)
    3 2026-09-12 10:01:45.209729 192.168.100.20 → 192.168.100.10 UDP 46 54144 → 55822 Len=4
    4 2026-09-12 10:02:07.874218 192.168.100.20 → 192.168.100.10 TFTP 64 Write Request, File: upload.txt, Transfer type: netascii
    5 2026-09-12 10:02:07.880190 192.168.100.10 → 192.168.100.20 TFTP 61 Error Code, Code: File not found, Message: File not found
    6 2026-09-12 10:02:13.525002 192.168.100.20 → 192.168.100.10 TFTP 64 Write Request, File: upload.txt, Transfer type: netascii
    7 2026-09-12 10:02:13.532589 192.168.100.10 → 192.168.100.20 TFTP 61 Error Code, Code: Not defined, Message: Request failed
    8 2026-09-12 10:02:19.359314 192.168.100.20 → 192.168.100.10 TFTP 64 Write Request, File: upload.txt, Transfer type: netascii
    9 2026-09-12 10:02:19.367159 192.168.100.10 → 192.168.100.20 TFTP 46 Acknowledgement, Block: 0
   10 2026-09-12 10:02:19.367998 192.168.100.20 → 192.168.100.10 UDP 65 52988 → 54084 Len=23
   11 2026-09-12 10:02:19.369136 192.168.100.10 → 192.168.100.20 TFTP 46 Acknowledgement, Block: 1
   12 2026-09-12 10:02:50.855073 192.168.100.20 → 192.168.100.10 TFTP 63 Read Request, File: hello.txt, Transfer type: netascii
   13 2026-09-12 10:02:55.856019 192.168.100.20 → 192.168.100.10 TFTP 63 Read Request, File: hello.txt, Transfer type: netascii
   14 2026-09-12 10:03:00.856469 192.168.100.20 → 192.168.100.10 TFTP 63 Read Request, File: hello.txt, Transfer type: netascii
   15 2026-09-12 10:03:05.856777 192.168.100.20 → 192.168.100.10 TFTP 63 Read Request, File: hello.txt, Transfer type: netascii
   16 2026-09-12 10:03:10.858100 192.168.100.20 → 192.168.100.10 TFTP 63 Read Request, File: hello.txt, Transfer type: netascii
$ tshark -r ubuntu-tftp.pcap -n -V -O tftp -Y 'frame.number == 2'
Frame 2: Packet, 74 bytes on wire (592 bits), 74 bytes captured (592 bits)
Ethernet II, Src: 52:54:00:b7:4d:fd, Dst: 52:54:00:ba:01:74
Internet Protocol Version 4, Src: 192.168.100.10, Dst: 192.168.100.20
User Datagram Protocol, Src Port: 55822, Dst Port: 54144
Trivial File Transfer Protocol
    Opcode: Data Packet (3)
    [Destination File: hello.txt]
    [Read Request in frame 1]
    Block: 1
    [Full Block Number: 1]
Data (28 bytes)

$ tshark -r ubuntu-tftp-no2.pcap -n -x
0000  52 54 00 ba 01 74 52 54 00 b7 4d fd 08 00 45 00   RT...tRT..M...E.
0010  00 3c 53 dc 00 00 40 11 dd 65 c0 a8 64 0a c0 a8   .<S...@..e..d...
0020  64 14 da 0e d3 80 00 28 08 c3 00 03 00 01 68 65   d......(......he
0030  6c 6c 6f 20 66 72 6f 6d 20 74 66 74 70 20 73 65   llo from tftp se
0040  72 76 65 72 20 73 76 31 0d 0a                     rver sv1..

$ tshark -r ubuntu-tftp.pcap -n -Y 'tftp.opcode == 5' -T fields -e frame.number -e tftp.error.code -e tftp.error.message
5	1	File not found
7	0	Request failed
$ tshark -r ubuntu-tftp.pcap -n -t ad -Y 'frame.number >= 8 && frame.number <= 11'
    8 2026-09-12 10:02:19.359314 192.168.100.20 → 192.168.100.10 TFTP 64 Write Request, File: upload.txt, Transfer type: netascii
    9 2026-09-12 10:02:19.367159 192.168.100.10 → 192.168.100.20 TFTP 46 Acknowledgement, Block: 0
   10 2026-09-12 10:02:19.367998 192.168.100.20 → 192.168.100.10 UDP 65 52988 → 54084 Len=23
   11 2026-09-12 10:02:19.369136 192.168.100.10 → 192.168.100.20 TFTP 46 Acknowledgement, Block: 1
$ tshark -r ubuntu-tftp.pcap -n -Y 'frame.number >= 12' -T fields -e frame.number -e frame.time_delta_displayed -e udp.srcport -e udp.dstport -e tftp.source_file
12		45348	69	hello.txt
13	5.000946000	45348	69	hello.txt
14	5.000450000	45348	69	hello.txt
15	5.000308000	45348	69	hello.txt
16	5.001323000	45348	69	hello.txt