PORTUnencryptedIANA assigned

Ports 67 and 68DHCP

DHCP uses two UDP ports: servers listen on 67 and clients listen on 68. A device without an address broadcasts a request from port 68 to port 67; the server answers to port 68 with an IP address, subnet mask, gateway and DNS servers. IPv6's DHCPv6 uses UDP 546 (client) and 547 (server).

BlackhawkHub Editorial · Updated

What ports 67 and 68 are used for

DHCP hands out network configuration automatically. The full mechanism is described in the DHCP record; at the port level the exchange is:

StepFromToMessage
1Client, UDP 68 (source 0.0.0.0)Broadcast, UDP 67DISCOVER
2Server, UDP 67Client, UDP 68OFFER
3Client, UDP 68Broadcast, UDP 67REQUEST
4Server, UDP 67Client, UDP 68ACK

The port numbers come from BOOTP, the 1985 protocol DHCP extended, which is why the IANA names are bootps and bootpc.

Security considerations

DHCP has no authentication. Any device on the segment can answer a DISCOVER, which allows a rogue DHCP server (a misconfigured home router plugged into an office network, or a deliberate attack) to hand out a malicious gateway or DNS server. Defences are network-side:

  • DHCP snooping on managed switches drops server messages from untrusted ports.
  • Limit which ports can carry DHCP server traffic in wireless controllers and VLAN policies.
  • Monitor for unexpected servers: a client that receives OFFERs from two addresses has a problem.

A workstation does not need to listen on 67. If netstat shows a 67 listener on a Windows PC, look for Internet Connection Sharing, a virtualisation product (VMware, VirtualBox and Hyper-V run DHCP for their virtual networks) or a mobile hotspot feature.

Checking DHCP on Windows

cmd
ipconfig /all

Under each adapter, DHCP Enabled, DHCP Server, Lease Obtained and Lease Expires show the current state. An address starting 169.254. means no DHCP server answered and Windows assigned an APIPA address.

cmd
ipconfig /release
ipconfig /renew

The ipconfig record covers these options.

Local listeners: netstat -ano -p udp | findstr :67 shows whether a DHCP server is running on this machine.

Firewall considerations

Windows Defender Firewall allows DHCP client traffic on UDP 68 by default; do not disable that rule or the machine cannot obtain an address. Inbound UDP 67 should be allowed only on systems that intentionally run a DHCP server.

On Windows, inbound rules live in Windows Defender Firewall with Advanced Security (wf.msc). A rule allowing port 67 only takes effect on the profile (Domain, Private, Public) it is assigned to. The command-line equivalent is netsh advfirewall firewall add rule; see the netsh record.

Frequently asked questions

Why does DHCP need two ports?

A new client has no IP address, so it broadcasts. Using fixed, distinct ports for server (67) and client (68) lets both sides identify DHCP traffic without knowing each other's address. The client port also lets a device with no address receive the reply.

Can DHCP cross routers?

Not by itself; broadcasts stop at the router. Routers run a DHCP relay agent that forwards requests to a central server, which is how one server can serve many subnets.

How do I see what DHCP gave my PC?

ipconfig /all shows the DHCP server address, lease obtained and lease expiry for each adapter. ipconfig /release followed by ipconfig /renew repeats the exchange.

Sources