Port 68: DHCP client
Port 68 is the DHCP client port, over UDP. A device sends its DHCPDISCOVER and DHCPREQUEST from source port 68 to the server on port 67, and the lease offer comes back to port 68.
| Port number | 68 |
|---|---|
| Service | DHCP client (BOOTP) |
| Protocol | UDP |
| Category | Core services |
| Default encryption | No |
| IANA service name | bootpc |
| IANA transports | TCP, UDP |
| Used in practice | UDP |
Do I need to open port 68 on my firewall?
On a client machine's own host firewall, usually yes, for inbound UDP 68, or DHCP renewal will silently fail and the machine will lose its address when the lease expires. Most operating systems create this rule for you.
On a network perimeter, no. DHCP is a link-local conversation: it starts as a broadcast and does not cross a router unless a relay agent deliberately forwards it. Allowing DHCP in from the internet has no legitimate purpose, and a rogue DHCP server handing out its own default gateway is a classic way to intercept a whole segment's traffic.
If clients on one segment need a server on another, the correct answer is a DHCP relay agent, not a firewall hole. The relay unicasts to port 67 on the real server, which keeps the broadcast contained.
Which ports are related to port 68?
The port a reader usually needs next is the encrypted or plaintext twin of this one, so those are listed first rather than buried in a generic list.
What commonly listens on port 68?
- dhclient, dhcpcd and systemd-networkd on Linux
- The DHCP Client service on Windows
- Effectively every phone, laptop, printer and IoT device on a normal network
How do I check whether port 68 is open?
Port 68 is UDP, which changes the answer: there is no handshake to complete, so nothing outside the host can prove the port is open. Asking the host itself is the reliable route.
| Question | Command | What to know |
|---|---|---|
| Is it open on a remote host? | sudo nmap -sU -p 68 example.com | UDP has no handshake, so there is nothing to complete. nmap infers the state from whether an ICMP port-unreachable comes back, needs root, and is slow and easy to misread. A silent port may be open, filtered, or simply not replying to a probe it does not recognise. |
| What is listening locally? | ss -ulnp | grep ':68 ' | Shows the UDP socket bound to port 68. This is the reliable way to answer the question, because you are asking the host itself rather than guessing from outside. |
Replace example.com with the host you are testing. A blocked port and a port with nothing listening on it look identical from the outside, so if a service should be running, check locally before blaming the firewall.
Frequently asked questions
What is port 68 used for?
It is the DHCP client port. A device that needs an IP address sends its DHCPDISCOVER and DHCPREQUEST messages from source port 68 to a DHCP server on port 67, and receives the offer and acknowledgement back on port 68. It is UDP.
Is port 68 TCP or UDP?
UDP. IANA has a historical TCP registration for bootpc, but DHCP is specified over UDP only, since the client broadcasts before it has an address of its own.
Is port 68 secure?
Port 68 is not encrypted by default. Where possible, use an encrypted alternative or tunnel it over TLS or a VPN.
Should I open port 68 on my firewall?
Only if you specifically need DHCP client. Expose it to the smallest set of trusted sources, and never open database or Windows-service ports to the whole internet.