Common attacks and weaknesses
- Rogue DHCP servers redirecting traffic (man in the middle).
- DHCP starvation.
Port 67: DHCP server
DHCP server side (clients use 68).
67
How DHCP server works
Network servicesA device asks the whole local network a question and the device that matches answers. It travels in clear text: anyone on the path can read it.
- Transport
- UDP · TCP
- Exposure risk
- 4/10 moderate if reachable from the Internet
- Encryption
- Clear textreadable on the network
- IANA status
- Assigned1 registered service
- Range
- Well-known (0-1023)
- Category
- Network services
Is port 67 dangerous?
How to secure it
- Enable DHCP snooping on switches.
IANA registry entries for port 67
| Service | Port | Transport | Description | Reference | Updated |
|---|---|---|---|---|---|
| bootps | 67 | TCP, UDP | Bootstrap Protocol Server | RFC 951 | - |
// source: IANA service name and port number registry
Which program uses port 67, and is it reachable?
Linux
sudo ss -ltnup 'sport = :67' # process listening on 67
sudo lsof -nP -i :67macOS
sudo lsof -nP -i :67
Windows (PowerShell)
Get-NetTCPConnection -LocalPort 67 -State Listen | Select LocalAddress, OwningProcess Get-NetUDPEndpoint -LocalPort 67 netstat -ano | findstr :67
From another machine
nmap -p 67 -sV <host> sudo nmap -sU -p 67 <host> nc -zv <host> 67
Block it in the firewall
sudo ufw deny 67/tcp # Linux (ufw) New-NetFirewallRule -DisplayName "Block 67" -Direction Inbound -LocalPort 67 -Protocol TCP -Action Block # Windows
What is port 67 used for?
DHCP server side (clients use 68).
Is port 67 TCP or UDP?
Port 67 is registered for UDP and TCP. In practice the service mostly uses UDP.
Is it safe to open port 67?
It is rated 4/10 (moderate) when exposed to the Internet. Rogue DHCP servers redirecting traffic (man in the middle). Enable DHCP snooping on switches.
How do I check if port 67 is open?
On Linux run "ss -ltnup 'sport = :67'", on macOS "lsof -nP -i :67", and on Windows "netstat -ano | findstr :67" to see the local process. From another machine, "nmap -p 67 <host>" shows whether it is reachable.