Port 67 DHCP server – Free, Online, Private

What listens on 67

Port 67 is where a DHCP server listens. The IANA name is bootps, Bootstrap Protocol Server, from the BOOTP days. DHCP was built on that. A client sends from UDP 68 to 255.255.255.255:67 because it does not have an address yet. The server replies toward port 68. IANA also lists TCP for these numbers. DHCP as deployed is UDP. A router does not forward the broadcast. A DHCP relay on the router unicasts the request to the server, still using these ports, which is why the server and the clients do not have to share a subnet if the relay is configured.

The IANA service name is bootps: Bootstrap Protocol Server. The practical transport is UDP. The checks below use UDP. A UDP socket has no listen state in the TCP sense, so lsof will not show -sTCP:LISTEN and nc cannot complete a handshake. A process can bind this port without being the service in the registry. The commands show who bound it. They do not prove the protocol on the wire is the one IANA named.

Service notes for port 67

Service notes for port 67: the IANA name is bootps (Bootstrap Protocol Server), and the program people mean is DHCP server. UDP 67 is the IANA bootps port, the DHCP and BOOTP server. Clients use UDP 68. The exchange is broadcast and does not cross a router unless a relay is configured. A rogue DHCP server on a segment hands out its own gateway and DNS, and then it sees the traffic. You will not notice from a port scan of the WAN. The listener is on the LAN, often a home router or a cloud metadata-style service. Protect the segment: DHCP snooping on switches, and no untrusted hosts on the same broadcast domain as the clients. Do not expose UDP 67 on a public interface. There is no reason for the internet to offer your machines an address. Nothing in that paragraph applies to a different number just because the software family is similar. If your listener is not on 67, you are on the wrong page.

Two servers on one segment, both on 67, give clients two answers and the client takes one. ss or lsof on each machine shows the daemon. A relay pointed at the wrong helper address is the other outage: clients broadcast, the relay forwards, nothing answers. Another trap is testing DHCP with nc. There is no handshake and the packet has to be a real DHCP message, usually broadcast. Another is a server bound to the wrong NIC, so the interface clients use never sees the reply.

How to check whether it is open

On the machine itself, ask the kernel which socket is bound. ss and lsof do that. A firewall, a security group, and a Docker publish rule sit in front of that socket, so a listener is not the same thing as a port the internet can use. From somewhere else, nc -vz host 67 tries a TCP handshake when the command is the TCP form. A refusal means something answered with a reset. A timeout means a filter dropped the packet or the host is unreachable. Those are different faults. Look for UDP 67 on the server, owned by dhcpd, dnsmasq, or a router process. You should not see it on a public address of an application host. From a client, a packet capture or a DHCP client debug log is the real test. nc -vzu does not speak DHCP.

grep and findstr match text. A pattern of :80 also matches :8080 and :8000. The lsof and Get-NetTCPConnection forms take a numeric port and do not have that substring bug. Use them when the number is ambiguous. ss filters in the kernel with sport = :N, which is also exact. On macOS, netstat -p selects a protocol. It does not print the process the way Linux netstat -p does. lsof prints the process.

• Port 68 is the client, bootpc. Scanning 67 from the internet does not test a LAN DHCP server.
• The traffic is broadcast. A TCP probe is the wrong tool, and a unicast UDP probe is still not a DHCP message.
• TCP 67 in the registry is not how DHCP is used.
• A relay is required across subnets. The port does not make a router forward broadcasts.

Linuxsudo ss -lpun 'sport = :67'
sudo lsof -nP -iUDP:67

macOSsudo lsof -nP -iUDP:67
netstat -anv -p udp | grep '\.67[^0-9]'

Windowsnetstat -ano | findstr :67
Get-NetUDPEndpoint -LocalPort 67

Remotenc -vzu host 67