> Can they tell whether it is a phone making the request? Yes, they can, because the phone sends TFTP extensions telling it's current firmware. The TFTP-Server then only sends new firmware if the firmware is actually new.