Skip to main content
IMMUNITYSEC

Port 67: Dynamic Host Configuration Protocol (server port)

UDP port 67 is the DHCP server port. RFC 2131 states that DHCP messages from clients to servers go to the server port (67) and replies go to the client port (68). DHCP servers hand out IP addresses and settings such as DNS servers and default routers; the IANA name bootps comes from the Bootstrap Protocol server role.

67
UDP

Port Details

Port
67
Transport
UDP
Service
DHCP
IANA service name
bootps
Range
System port (0-1023)
Related ports
68

Security Exposure

DHCP is built on UDP and IP without authentication, and RFC 2131 warns that unauthorized DHCP servers are easy to set up. A rogue server can give clients wrong addresses, spoofed routers, and spoofed DNS servers, which lets an attacker on the local network redirect traffic. A malicious client can also claim every available address and deny service to legitimate clients.

Hardening

  • +Enable DHCP snooping on access switches so DHCP server messages arriving on untrusted ports are dropped.
  • +Mark only switch ports that face legitimate DHCP servers or relay agents as trusted.
  • +In Active Directory domains, authorize Windows DHCP servers so unauthorized servers do not lease addresses.
  • +Do not expose UDP 67 to networks outside the subnets the server is meant to serve.

Monitoring

Alert on DHCP offers from unknown server addresses and on large numbers of DHCP requests from one switch port. The DHCP snooping binding database records MAC address, leased IP, port, and VLAN for review.

DHCP Vulnerabilities

1 CVEs
CVETitleVendorCVSSEPSSKEVPublished
CVE-2017-12240
Cisco IOS and IOS XE Software DHCP Remote Code Execution Vulnerability
-9.813.8%KEV2017-09-28

Tools for Auditing and Monitoring DHCP

Nmap

Free / Commercial
Penetration Testing Tools

Network discovery scanner and port auditor for discovering live hosts, open ports, running services, and OS fingerprints.

LicenseNPSL-0.95 (Nmap Public Source License, not OSI-approved)
PlatformLinux, macOS, Windows

Zeek

Open Source
Network Monitoring Tools

Network security monitoring framework that translates raw packet traffic into structured transaction logs and network events.

LicenseBSD-3-Clause
PlatformLinux, FreeBSD, macOS, OpenBSD

Wireshark

Open Source
Network Monitoring Tools

Network packet analyzer and protocol inspection tool for capturing live traffic and debugging network communications in detail.

LicenseGPL-2.0-or-later
PlatformWindows, macOS, Linux, BSD

Related Tool Categories

Network Monitoring Tools→

Packet capture tools, protocol analyzers, and network security monitors for traffic visibility.

Network Security Tools→

Zero trust access, secure web gateways, firewalls, and perimeter enforcement platforms.

Frequently Asked Questions

What is the difference between port 67 and 68?→

Port 67 is the DHCP server port and port 68 is the DHCP client port. Clients send to port 67 and servers reply to port 68 (RFC 2131).

Is DHCP TCP or UDP?→

DHCP runs over UDP. RFC 2131 describes it as built directly on UDP and IP, although IANA also lists TCP entries for ports 67 and 68.

What is a rogue DHCP server?→

It is an unauthorized server that answers DHCP requests with false settings such as wrong routers or DNS servers (RFC 2131). DHCP snooping on switches blocks it by dropping server replies from untrusted ports.

Which vulnerabilities affect the service on port 67?→

This database lists 1 CVE related to DHCP, 1 of them confirmed as exploited by CISA. Examples: CVE-2017-12240.

Sources

Port assignments from the IANA Service Name and Transport Protocol Port Number Registry. Services can be configured to run on any port, so traffic on port 67 is not guaranteed to be DHCP. Exploited-in-the-wild data from the CISA KEV catalog (CC0).