Subject: Re: [vserver] tftp server problem
From: Corin Langosch <corinl@gmx.de>
Date: Tue, 19 Feb 2008 16:14:57 +0100
Tue, 19 Feb 2008 16:14:57 +0100
Hi!

Just one note to my last email...when running atftpd on the host (where 
it works),
tcpdump looks like this:

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
16:12:51.748559 arp who-has 192.168.1.254 tell 192.168.1.32
16:12:51.748653 IP 192.168.1.32.2070 > 192.168.1.254.69:  27 RRQ 
"pxelinux.0" octet tsize 0
16:12:51.749674 IP 192.168.1.254.32981 > 192.168.1.32.2070: UDP, length 14
16:12:51.749761 IP 192.168.1.32.2070 > 192.168.1.254.32981: UDP, length 17
16:12:51.756283 IP 192.168.1.32.2071 > 192.168.1.254.69:  32 RRQ 
"pxelinux.0" octet blksize 1456
16:12:51.757188 IP 192.168.1.254.32981 > 192.168.1.32.2071: UDP, length 15
16:12:51.757280 IP 192.168.1.32.2071 > 192.168.1.254.32981: UDP, length 4
16:12:51.757389 IP 192.168.1.254.32981 > 192.168.1.32.2071: UDP, length 1460
16:12:51.757826 IP 192.168.1.32.2071 > 192.168.1.254.32981: UDP, length 4
16:12:51.757865 IP 192.168.1.254.32981 > 192.168.1.32.2071: UDP, length 1460
16:12:51.758333 IP 192.168.1.32.2071 > 192.168.1.254.32981: UDP, length 4
16:12:51.758379 IP 192.168.1.254.32981 > 192.168.1.32.2071: UDP, length 1460
16:12:51.758840 IP 192.168.1.32.2071 > 192.168.1.254.32981: UDP, length 4
16:12:51.758877 IP 192.168.1.254.32981 > 192.168.1.32.2071: UDP, length 1460
16:12:51.759354 IP 192.168.1.32.2071 > 192.168.1.254.32981: UDP, length 4
16:12:51.760131 IP 192.168.1.254.32981 > 192.168.1.32.2071: UDP, length 1460
16:12:51.760574 IP 192.168.1.32.2071 > 192.168.1.254.32981: UDP, length 4
16:12:51.760626 IP 192.168.1.254.32981 > 192.168.1.32.2071: UDP, length 1460
16:12:51.761079 IP 192.168.1.32.2071 > 192.168.1.254.32981: UDP, length 4
16:12:51.761607 IP 192.168.1.254.32981 > 192.168.1.32.2071: UDP, length 1460
16:12:51.762045 IP 192.168.1.32.2071 > 192.168.1.254.32981: UDP, length 4
16:12:51.762088 IP 192.168.1.254.32981 > 192.168.1.32.2071: UDP, length 1460
16:12:51.762611 IP 192.168.1.32.2071 > 192.168.1.254.32981: UDP, length 4
16:12:51.762654 IP 192.168.1.254.32981 > 192.168.1.32.2071: UDP, length 1460
16:12:51.763124 IP 192.168.1.32.2071 > 192.168.1.254.32981: UDP, length 4
16:12:51.763161 IP 192.168.1.254.32981 > 192.168.1.32.2071: UDP, length 892
16:12:51.763636 IP 192.168.1.32.2071 > 192.168.1.254.32981: UDP, length 4
16:12:51.796960 IP 192.168.1.32.57089 > 192.168.1.254.69:  79 RRQ 
"pxelinux.cfg/00020003-0004-0005-0006-000700080009" oc
16:12:51.797723 IP 192.168.1.254.32981 > 192.168.1.32.57089: UDP, length 19
16:12:51.800977 IP 192.168.1.32.57090 > 192.168.1.254.69:  63 RRQ 
"pxelinux.cfg/01-00-13-8f-56-02-81" octet tsize 0 blks
16:12:51.801748 IP 192.168.1.254.32981 > 192.168.1.32.57090: UDP, length 19
16:12:51.804239 IP 192.168.1.32.57091 > 192.168.1.254.69:  51 RRQ 
"pxelinux.cfg/C0A80120" octet tsize 0 blksize 1408
16:12:51.804993 IP 192.168.1.254.32981 > 192.168.1.32.57091: UDP, length 19
16:12:51.807434 IP 192.168.1.32.57092 > 192.168.1.254.69:  50 RRQ 
"pxelinux.cfg/C0A8012" octet tsize 0 blksize 1408
16:12:51.808191 IP 192.168.1.254.32981 > 192.168.1.32.57092: UDP, length 19
16:12:51.810559 IP 192.168.1.32.57093 > 192.168.1.254.69:  49 RRQ 
"pxelinux.cfg/C0A801" octet tsize 0 blksize 1408
16:12:51.811367 IP 192.168.1.254.32981 > 192.168.1.32.57093: UDP, length 19
16:12:51.816844 IP 192.168.1.32.57094 > 192.168.1.254.69:  48 RRQ 
"pxelinux.cfg/C0A80" octet tsize 0 blksize 1408
16:12:51.817791 IP 192.168.1.254.32981 > 192.168.1.32.57094: UDP, length 19
16:12:51.823196 IP 192.168.1.32.57095 > 192.168.1.254.69:  47 RRQ 
"pxelinux.cfg/C0A8" octet tsize 0 blksize 1408
16:12:51.823948 IP 192.168.1.254.32981 > 192.168.1.32.57095: UDP, length 19
16:12:51.829294 IP 192.168.1.32.57096 > 192.168.1.254.69:  46 RRQ 
"pxelinux.cfg/C0A" octet tsize 0 blksize 1408
16:12:51.830026 IP 192.168.1.254.32981 > 192.168.1.32.57096: UDP, length 19
16:12:51.835317 IP 192.168.1.32.57097 > 192.168.1.254.69:  45 RRQ 
"pxelinux.cfg/C0" octet tsize 0 blksize 1408
16:12:51.836045 IP 192.168.1.254.32981 > 192.168.1.32.57097: UDP, length 19
16:12:51.841257 IP 192.168.1.32.57098 > 192.168.1.254.69:  44 RRQ 
"pxelinux.cfg/C" octet tsize 0 blksize 1408
16:12:51.842057 IP 192.168.1.254.32981 > 192.168.1.32.57098: UDP, length 19
16:12:51.847670 IP 192.168.1.32.57099 > 192.168.1.254.69:  50 RRQ 
"pxelinux.cfg/default" octet tsize 0 blksize 1408
16:12:51.848590 IP 192.168.1.254.32981 > 192.168.1.32.57099: UDP, length 26
16:12:51.848683 IP 192.168.1.32.57099 > 192.168.1.254.32981: UDP, length 4
16:12:51.848790 IP 192.168.1.254.32981 > 192.168.1.32.57099: UDP, length 
1009
16:12:51.849125 IP 192.168.1.32.57099 > 192.168.1.254.32981: UDP, length 4
16:12:51.853268 IP 192.168.1.32.57100 > 192.168.1.254.69:  47 RRQ 
"screens/intro.txt" octet tsize 0 blksize 1408
16:12:51.854254 IP 192.168.1.254.32981 > 192.168.1.32.57100: UDP, length 25
16:12:51.854358 IP 192.168.1.32.57100 > 192.168.1.254.32981: UDP, length 4
16:12:51.855629 IP 192.168.1.254.32981 > 192.168.1.32.57100: UDP, length 542
16:12:51.855837 IP 192.168.1.32.57100 > 192.168.1.254.32981: UDP, length 4

Corin

Corin Langosch schrieb:
> Hi!
>
> I added all caps, but it still does not work :-(
>
> buero:/etc/vservers# cat system/bcapabilities
> NET_RAW
> NET_BROADCAST
> SYS_TIME
> SYS_NICE
> SYS_RESOURCE
>
> The caps must be set as the dhcp server inside the vserver is running 
> fine, which
> wont without the caps.
>
> No tftp server is not running inside the host, I unsinatlled it there. 
> "netstat -l -p" confirms this.
> Otherwise the tftpd inside the host wouldn't be able to bind to the 
> port neither..?
>
> This is my tcpdump from the host:
>
> buero:/etc/vservers# tcpdump -n | grep '\.1\.203'
> tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
> listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
> 16:02:32.108114 IP 192.168.1.203.67 > 255.255.255.255.68: BOOTP/DHCP, 
> Reply, length 300
> 16:02:34.198749 IP 192.168.1.203.67 > 255.255.255.255.68: BOOTP/DHCP, 
> Reply, length 300
> 16:02:34.206389 arp who-has 192.168.1.203 tell 192.168.1.32
> 16:02:34.206410 arp reply 192.168.1.203 is-at 00:13:8f:56:02:96
> 16:02:34.206614 IP 192.168.1.32.2070 > 192.168.1.203.69:  27 RRQ 
> "pxelinux.0" octet tsize 0
> 16:02:34.207638 IP 192.168.1.32.2070 > 192.168.1.203.32973: UDP, length 17
> 16:02:34.207674 IP 192.168.1.203 > 192.168.1.32: ICMP 192.168.1.203 
> udp port 32973 unreachable, length 53
> 16:02:34.214165 IP 192.168.1.32.2071 > 192.168.1.203.69:  32 RRQ 
> "pxelinux.0" octet blksize 1456
> 16:02:34.215175 IP 192.168.1.32.2071 > 192.168.1.203.32974: UDP, length 4
> 16:02:34.215207 IP 192.168.1.203 > 192.168.1.32: ICMP 192.168.1.203 
> udp port 32974 unreachable, length 40
> 16:02:37.968200 IP 192.168.1.32.2071 > 192.168.1.203.32972: UDP, length 4
> 16:02:37.968234 IP 192.168.1.203 > 192.168.1.32: ICMP 192.168.1.203 
> udp port 32972 unreachable, length 40
> 16:02:39.216366 IP 192.168.1.32.2071 > 192.168.1.203.32974: UDP, length 4
> 16:02:39.216400 IP 192.168.1.203 > 192.168.1.32: ICMP 192.168.1.203 
> udp port 32974 unreachable, length 40
> 16:02:42.972429 IP 192.168.1.32.2071 > 192.168.1.203.32972: UDP, length 4
> 16:02:42.972464 IP 192.168.1.203 > 192.168.1.32: ICMP 192.168.1.203 
> udp port 32972 unreachable, length 40
> 16:02:44.220570 IP 192.168.1.32.2071 > 192.168.1.203.32974: UDP, length 4
> 16:02:44.220606 IP 192.168.1.203 > 192.168.1.32: ICMP 192.168.1.203 
> udp port 32974 unreachable, length 40
> 16:02:49.224788 IP 192.168.1.32.2071 > 192.168.1.203.32974: UDP, length 4
> 16:02:49.224822 IP 192.168.1.203 > 192.168.1.32: ICMP 192.168.1.203 
> udp port 32974 unreachable, length 40
> 16:02:54.225850 IP 192.168.1.32.2071 > 192.168.1.203.32974: UDP, length 4
> 16:02:54.225885 IP 192.168.1.203 > 192.168.1.32: ICMP 192.168.1.203 
> udp port 32974 unreachable, length 40
> 16:02:59.230023 IP 192.168.1.32.2071 > 192.168.1.203.32974: UDP, length 4
> 16:02:59.230059 IP 192.168.1.203 > 192.168.1.32: ICMP 192.168.1.203 
> udp port 32974 unreachable, length 40
> 16:03:10.223642 IP 192.168.1.32.2072 > 192.168.1.203.69:  32 ACK block 0
>
> For me it seems that the chosen data-port for the transfer by the 
> server is somehow not reachable?
> What could the reason be, how to solve it?
>
> Corin
>
>
> Thomas Weber schrieb:
>> Am Montag, den 18.02.2008, 19:15 +0100 schrieb Corin Langosch:
>>   
>>> Hi!
>>>
>>> I already had NET_RAW in my bcapabilities for dhcp-server. Adding
>>> RAW_ICMP to
>>> ccapabilities didn't change anything.
>>>
>>> buero:/etc/vservers/system# cat bcapabilities
>>> CAP_NET_RAW
>>> CAP_NET_BROADCAST
>>> CAP_SYS_TIME
>>>     
>>
>> ehm... try without the CAP_
>> /etc/vservers/services# cat bcapabilities
>> SYS_NICE
>> SYS_RESOURCE
>> NET_RAW
>>
>> not sure if you need all of these for atfpd. But with these bind9, dhcp,
>> atftd plus some others work fine.
>>
>>   
>>> buero:/etc/vservers/system# cat ccapabilities
>>> RAW_ICMP
>>>     
>>
>> no need for ccapabilities here.
>>
>>   
>>> Any other hints? How to trace the traffic  flow?
>>>     
>>
>> I know its a stupid question: did you make sure to disable the tftpd on
>> the root system?
>>
>> You can capture the traffic with tcpdump on the host.
>>
>>   Tom
>>
>>   


Hi!

Just one note to my last email...when running atftpd on the host (where it works),
tcpdump looks like this:

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
16:12:51.748559 arp who-has 192.168.1.254 tell 192.168.1.32
16:12:51.748653 IP 192.168.1.32.2070 > 192.168.1.254.69:  27 RRQ "pxelinux.0" octet tsize 0
16:12:51.749674 IP 192.168.1.254.32981 > 192.168.1.32.2070: UDP, length 14
16:12:51.749761 IP 192.168.1.32.2070 > 192.168.1.254.32981: UDP, length 17
16:12:51.756283 IP 192.168.1.32.2071 > 192.168.1.254.69:  32 RRQ "pxelinux.0" octet blksize 1456
16:12:51.757188 IP 192.168.1.254.32981 > 192.168.1.32.2071: UDP, length 15
16:12:51.757280 IP 192.168.1.32.2071 > 192.168.1.254.32981: UDP, length 4
16:12:51.757389 IP 192.168.1.254.32981 > 192.168.1.32.2071: UDP, length 1460
16:12:51.757826 IP 192.168.1.32.2071 > 192.168.1.254.32981: UDP, length 4
16:12:51.757865 IP 192.168.1.254.32981 > 192.168.1.32.2071: UDP, length 1460
16:12:51.758333 IP 192.168.1.32.2071 > 192.168.1.254.32981: UDP, length 4
16:12:51.758379 IP 192.168.1.254.32981 > 192.168.1.32.2071: UDP, length 1460
16:12:51.758840 IP 192.168.1.32.2071 > 192.168.1.254.32981: UDP, length 4
16:12:51.758877 IP 192.168.1.254.32981 > 192.168.1.32.2071: UDP, length 1460
16:12:51.759354 IP 192.168.1.32.2071 > 192.168.1.254.32981: UDP, length 4
16:12:51.760131 IP 192.168.1.254.32981 > 192.168.1.32.2071: UDP, length 1460
16:12:51.760574 IP 192.168.1.32.2071 > 192.168.1.254.32981: UDP, length 4
16:12:51.760626 IP 192.168.1.254.32981 > 192.168.1.32.2071: UDP, length 1460
16:12:51.761079 IP 192.168.1.32.2071 > 192.168.1.254.32981: UDP, length 4
16:12:51.761607 IP 192.168.1.254.32981 > 192.168.1.32.2071: UDP, length 1460
16:12:51.762045 IP 192.168.1.32.2071 > 192.168.1.254.32981: UDP, length 4
16:12:51.762088 IP 192.168.1.254.32981 > 192.168.1.32.2071: UDP, length 1460
16:12:51.762611 IP 192.168.1.32.2071 > 192.168.1.254.32981: UDP, length 4
16:12:51.762654 IP 192.168.1.254.32981 > 192.168.1.32.2071: UDP, length 1460
16:12:51.763124 IP 192.168.1.32.2071 > 192.168.1.254.32981: UDP, length 4
16:12:51.763161 IP 192.168.1.254.32981 > 192.168.1.32.2071: UDP, length 892
16:12:51.763636 IP 192.168.1.32.2071 > 192.168.1.254.32981: UDP, length 4
16:12:51.796960 IP 192.168.1.32.57089 > 192.168.1.254.69:  79 RRQ "pxelinux.cfg/00020003-0004-0005-0006-000700080009" oc
16:12:51.797723 IP 192.168.1.254.32981 > 192.168.1.32.57089: UDP, length 19
16:12:51.800977 IP 192.168.1.32.57090 > 192.168.1.254.69:  63 RRQ "pxelinux.cfg/01-00-13-8f-56-02-81" octet tsize 0 blks
16:12:51.801748 IP 192.168.1.254.32981 > 192.168.1.32.57090: UDP, length 19
16:12:51.804239 IP 192.168.1.32.57091 > 192.168.1.254.69:  51 RRQ "pxelinux.cfg/C0A80120" octet tsize 0 blksize 1408
16:12:51.804993 IP 192.168.1.254.32981 > 192.168.1.32.57091: UDP, length 19
16:12:51.807434 IP 192.168.1.32.57092 > 192.168.1.254.69:  50 RRQ "pxelinux.cfg/C0A8012" octet tsize 0 blksize 1408
16:12:51.808191 IP 192.168.1.254.32981 > 192.168.1.32.57092: UDP, length 19
16:12:51.810559 IP 192.168.1.32.57093 > 192.168.1.254.69:  49 RRQ "pxelinux.cfg/C0A801" octet tsize 0 blksize 1408
16:12:51.811367 IP 192.168.1.254.32981 > 192.168.1.32.57093: UDP, length 19
16:12:51.816844 IP 192.168.1.32.57094 > 192.168.1.254.69:  48 RRQ "pxelinux.cfg/C0A80" octet tsize 0 blksize 1408
16:12:51.817791 IP 192.168.1.254.32981 > 192.168.1.32.57094: UDP, length 19
16:12:51.823196 IP 192.168.1.32.57095 > 192.168.1.254.69:  47 RRQ "pxelinux.cfg/C0A8" octet tsize 0 blksize 1408
16:12:51.823948 IP 192.168.1.254.32981 > 192.168.1.32.57095: UDP, length 19
16:12:51.829294 IP 192.168.1.32.57096 > 192.168.1.254.69:  46 RRQ "pxelinux.cfg/C0A" octet tsize 0 blksize 1408
16:12:51.830026 IP 192.168.1.254.32981 > 192.168.1.32.57096: UDP, length 19
16:12:51.835317 IP 192.168.1.32.57097 > 192.168.1.254.69:  45 RRQ "pxelinux.cfg/C0" octet tsize 0 blksize 1408
16:12:51.836045 IP 192.168.1.254.32981 > 192.168.1.32.57097: UDP, length 19
16:12:51.841257 IP 192.168.1.32.57098 > 192.168.1.254.69:  44 RRQ "pxelinux.cfg/C" octet tsize 0 blksize 1408
16:12:51.842057 IP 192.168.1.254.32981 > 192.168.1.32.57098: UDP, length 19
16:12:51.847670 IP 192.168.1.32.57099 > 192.168.1.254.69:  50 RRQ "pxelinux.cfg/default" octet tsize 0 blksize 1408
16:12:51.848590 IP 192.168.1.254.32981 > 192.168.1.32.57099: UDP, length 26
16:12:51.848683 IP 192.168.1.32.57099 > 192.168.1.254.32981: UDP, length 4
16:12:51.848790 IP 192.168.1.254.32981 > 192.168.1.32.57099: UDP, length 1009
16:12:51.849125 IP 192.168.1.32.57099 > 192.168.1.254.32981: UDP, length 4
16:12:51.853268 IP 192.168.1.32.57100 > 192.168.1.254.69:  47 RRQ "screens/intro.txt" octet tsize 0 blksize 1408
16:12:51.854254 IP 192.168.1.254.32981 > 192.168.1.32.57100: UDP, length 25
16:12:51.854358 IP 192.168.1.32.57100 > 192.168.1.254.32981: UDP, length 4
16:12:51.855629 IP 192.168.1.254.32981 > 192.168.1.32.57100: UDP, length 542
16:12:51.855837 IP 192.168.1.32.57100 > 192.168.1.254.32981: UDP, length 4

Corin

Corin Langosch schrieb:
Hi!

I added all caps, but it still does not work :-(

buero:/etc/vservers# cat system/bcapabilities
NET_RAW
NET_BROADCAST
SYS_TIME
SYS_NICE
SYS_RESOURCE

The caps must be set as the dhcp server inside the vserver is running fine, which
wont without the caps.

No tftp server is not running inside the host, I unsinatlled it there. "netstat -l -p" confirms this.
Otherwise the tftpd inside the host wouldn't be able to bind to the port neither..?

This is my tcpdump from the host:

buero:/etc/vservers# tcpdump -n | grep '\.1\.203'
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
16:02:32.108114 IP 192.168.1.203.67 > 255.255.255.255.68: BOOTP/DHCP, Reply, length 300
16:02:34.198749 IP 192.168.1.203.67 > 255.255.255.255.68: BOOTP/DHCP, Reply, length 300
16:02:34.206389 arp who-has 192.168.1.203 tell 192.168.1.32
16:02:34.206410 arp reply 192.168.1.203 is-at 00:13:8f:56:02:96
16:02:34.206614 IP 192.168.1.32.2070 > 192.168.1.203.69:  27 RRQ "pxelinux.0" octet tsize 0
16:02:34.207638 IP 192.168.1.32.2070 > 192.168.1.203.32973: UDP, length 17
16:02:34.207674 IP 192.168.1.203 > 192.168.1.32: ICMP 192.168.1.203 udp port 32973 unreachable, length 53
16:02:34.214165 IP 192.168.1.32.2071 > 192.168.1.203.69:  32 RRQ "pxelinux.0" octet blksize 1456
16:02:34.215175 IP 192.168.1.32.2071 > 192.168.1.203.32974: UDP, length 4
16:02:34.215207 IP 192.168.1.203 > 192.168.1.32: ICMP 192.168.1.203 udp port 32974 unreachable, length 40
16:02:37.968200 IP 192.168.1.32.2071 > 192.168.1.203.32972: UDP, length 4
16:02:37.968234 IP 192.168.1.203 > 192.168.1.32: ICMP 192.168.1.203 udp port 32972 unreachable, length 40
16:02:39.216366 IP 192.168.1.32.2071 > 192.168.1.203.32974: UDP, length 4
16:02:39.216400 IP 192.168.1.203 > 192.168.1.32: ICMP 192.168.1.203 udp port 32974 unreachable, length 40
16:02:42.972429 IP 192.168.1.32.2071 > 192.168.1.203.32972: UDP, length 4
16:02:42.972464 IP 192.168.1.203 > 192.168.1.32: ICMP 192.168.1.203 udp port 32972 unreachable, length 40
16:02:44.220570 IP 192.168.1.32.2071 > 192.168.1.203.32974: UDP, length 4
16:02:44.220606 IP 192.168.1.203 > 192.168.1.32: ICMP 192.168.1.203 udp port 32974 unreachable, length 40
16:02:49.224788 IP 192.168.1.32.2071 > 192.168.1.203.32974: UDP, length 4
16:02:49.224822 IP 192.168.1.203 > 192.168.1.32: ICMP 192.168.1.203 udp port 32974 unreachable, length 40
16:02:54.225850 IP 192.168.1.32.2071 > 192.168.1.203.32974: UDP, length 4
16:02:54.225885 IP 192.168.1.203 > 192.168.1.32: ICMP 192.168.1.203 udp port 32974 unreachable, length 40
16:02:59.230023 IP 192.168.1.32.2071 > 192.168.1.203.32974: UDP, length 4
16:02:59.230059 IP 192.168.1.203 > 192.168.1.32: ICMP 192.168.1.203 udp port 32974 unreachable, length 40
16:03:10.223642 IP 192.168.1.32.2072 > 192.168.1.203.69:  32 ACK block 0

For me it seems that the chosen data-port for the transfer by the server is somehow not reachable?
What could the reason be, how to solve it?

Corin


Thomas Weber schrieb:
Am Montag, den 18.02.2008, 19:15 +0100 schrieb Corin Langosch:
  
Hi!

I already had NET_RAW in my bcapabilities for dhcp-server. Adding
RAW_ICMP to
ccapabilities didn't change anything.

buero:/etc/vservers/system# cat bcapabilities
CAP_NET_RAW
CAP_NET_BROADCAST
CAP_SYS_TIME
    

ehm... try without the CAP_
/etc/vservers/services# cat bcapabilities
SYS_NICE
SYS_RESOURCE
NET_RAW

not sure if you need all of these for atfpd. But with these bind9, dhcp,
atftd plus some others work fine.

  
buero:/etc/vservers/system# cat ccapabilities
RAW_ICMP
    

no need for ccapabilities here.

  
Any other hints? How to trace the traffic  flow?
    

I know its a stupid question: did you make sure to disable the tftpd on
the root system?

You can capture the traffic with tcpdump on the host.

  Tom