Port 67: DHCP
Port 67 is the DHCP server port, over UDP. A server listens here for DHCPDISCOVER and DHCPREQUEST messages that clients broadcast from port 68, and replies with an address lease.
| Port number | 67 |
|---|---|
| Service | DHCP server (BOOTP) |
| Protocol | UDP |
| Category | Core services |
| Default encryption | No |
| IANA service name | bootps |
| IANA transports | TCP, UDP |
| Used in practice | UDP |
Why does DHCP use two ports instead of one?
Because when the conversation starts the client has no IP address at all, so it cannot receive a normal reply. It broadcasts its request to 255.255.255.255 from source port 68, and the server broadcasts or unicasts its reply to destination port 68.
Using two fixed ports lets both sides tell request from reply without any connection state, and lets a client recognise a reply that arrives as a broadcast to the whole segment. If both directions used the same port, a client would see every other client's traffic as potentially its own.
It also means DHCP cannot cross a router on its own, because routers do not forward broadcasts. That is what a DHCP relay agent is for: it listens on the local segment, then unicasts the request to a DHCP server on port 67 elsewhere in the network.
Which ports are related to port 67?
The port a reader usually needs next is the encrypted or plaintext twin of this one, so those are listed first rather than buried in a generic list.
What commonly listens on port 67?
- ISC DHCP and Kea on Linux servers
- dnsmasq on routers and small networks
- The DHCP Server role on Windows Server
- A DHCP relay agent, which forwards broadcasts across a router to a central server
How do I check whether port 67 is open?
Port 67 is UDP, which changes the answer: there is no handshake to complete, so nothing outside the host can prove the port is open. Asking the host itself is the reliable route.
| Question | Command | What to know |
|---|---|---|
| Is it open on a remote host? | sudo nmap -sU -p 67 example.com | UDP has no handshake, so there is nothing to complete. nmap infers the state from whether an ICMP port-unreachable comes back, needs root, and is slow and easy to misread. A silent port may be open, filtered, or simply not replying to a probe it does not recognise. |
| What is listening locally? | ss -ulnp | grep ':67 ' | Shows the UDP socket bound to port 67. This is the reliable way to answer the question, because you are asking the host itself rather than guessing from outside. |
Replace example.com with the host you are testing. A blocked port and a port with nothing listening on it look identical from the outside, so if a service should be running, check locally before blaming the firewall.
Frequently asked questions
What is the difference between port 67 and port 68?
Port 67 is the server, port 68 is the client. A client broadcasts its DHCPDISCOVER and DHCPREQUEST from source port 68 to destination port 67, and the server answers from port 67 to port 68. Both are UDP.
Is DHCP TCP or UDP?
UDP. IANA has a historical TCP registration for bootps on port 67, but DHCP is specified over UDP only, and it has to be, because the client has no address yet and relies on broadcast.
What is port 67 used for?
Port 67 is the DHCP server port, over UDP. A server listens here for DHCPDISCOVER and DHCPREQUEST messages that clients broadcast from port 68, and replies with an address lease.
Is port 67 TCP or UDP?
IANA assigns port 67 on TCP, UDP. In practice it carries UDP. IANA registers bootps on both transports, but DHCP is defined over UDP only. The service name still says BOOTP because DHCP was built as an extension of it.
Is port 67 secure?
Port 67 is not encrypted by default. Where possible, use an encrypted alternative or tunnel it over TLS or a VPN.
Should I open port 67 on my firewall?
Only if you specifically need DHCP. Expose it to the smallest set of trusted sources, and never open database or Windows-service ports to the whole internet.