PORTUnencryptedIANA assigned
Ports 67 and 68DHCP
DHCP uses two UDP ports: servers listen on 67 and clients listen on 68. A device without an address broadcasts a request from port 68 to port 67; the server answers to port 68 with an IP address, subnet mask, gateway and DNS servers. IPv6's DHCPv6 uses UDP 546 (client) and 547 (server).
What ports 67 and 68 are used for
DHCP hands out network configuration automatically. The full mechanism is described in the DHCP record; at the port level the exchange is:
| Step | From | To | Message |
|---|---|---|---|
| 1 | Client, UDP 68 (source 0.0.0.0) | Broadcast, UDP 67 | DISCOVER |
| 2 | Server, UDP 67 | Client, UDP 68 | OFFER |
| 3 | Client, UDP 68 | Broadcast, UDP 67 | REQUEST |
| 4 | Server, UDP 67 | Client, UDP 68 | ACK |
The port numbers come from BOOTP, the 1985 protocol DHCP extended, which is why the IANA names are bootps and bootpc.
Security considerations
DHCP has no authentication. Any device on the segment can answer a DISCOVER, which allows a rogue DHCP server (a misconfigured home router plugged into an office network, or a deliberate attack) to hand out a malicious gateway or DNS server. Defences are network-side:
- DHCP snooping on managed switches drops server messages from untrusted ports.
- Limit which ports can carry DHCP server traffic in wireless controllers and VLAN policies.
- Monitor for unexpected servers: a client that receives OFFERs from two addresses has a problem.
A workstation does not need to listen on 67. If netstat shows a 67 listener on a Windows PC, look for Internet Connection Sharing, a virtualisation product (VMware, VirtualBox and Hyper-V run DHCP for their virtual networks) or a mobile hotspot feature.
Checking DHCP on Windows
ipconfig /allUnder each adapter, DHCP Enabled, DHCP Server, Lease Obtained and Lease Expires show the current state. An address starting 169.254. means no DHCP server answered and Windows assigned an APIPA address.
ipconfig /release
ipconfig /renewThe ipconfig record covers these options.
Local listeners: netstat -ano -p udp | findstr :67 shows whether a DHCP server is running on this machine.
Firewall considerations
Windows Defender Firewall allows DHCP client traffic on UDP 68 by default; do not disable that rule or the machine cannot obtain an address. Inbound UDP 67 should be allowed only on systems that intentionally run a DHCP server.
On Windows, inbound rules live in Windows Defender Firewall with Advanced Security (wf.msc). A rule allowing port 67 only takes effect on the profile (Domain, Private, Public) it is assigned to. The command-line equivalent is netsh advfirewall firewall add rule; see the netsh record.
Frequently asked questions
Why does DHCP need two ports?
A new client has no IP address, so it broadcasts. Using fixed, distinct ports for server (67) and client (68) lets both sides identify DHCP traffic without knowing each other's address. The client port also lets a device with no address receive the reply.
Can DHCP cross routers?
Not by itself; broadcasts stop at the router. Routers run a DHCP relay agent that forwards requests to a central server, which is how one server can serve many subnets.
How do I see what DHCP gave my PC?
ipconfig /all shows the DHCP server address, lease obtained and lease expiry for each adapter. ipconfig /release followed by ipconfig /renew repeats the exchange.