Port 68BOOTP/DHCP Client

Port 68 is primarily used by the Bootstrap Protocol (BOOTP) Client and the Dynamic Host Configuration Protocol (DHCP) Client. These protocols enable network devices to automatically obtain configuration information such as IP addresses, subnet masks, and gateway addresses. Defined as the destination port for clients in the BOOTP and DHCP process, it is crucial for network initialization and address management within enterprise and home networks alike..

transport
udp

single transport

in transit
cleartext

payload readable on path

assignment
official

registered with iana

risk
4/10

caution

lookups
6,661

rank 769 of 993 · top 77%

Technical Details

what runs on :68

The Bootstrap Protocol (BOOTP) and Dynamic Host Configuration Protocol (DHCP) are foundational network services that simplify device configuration in IP-based networks. BOOTP was the original protocol designed for bootstrap loading, allowing diskless clients to discover their IP address and a boot server from which they could load their operating system. DHCP extended BOOTP, introducing dynamic leasing capabilities that automate IP address allocation and manage address exhaustion issues.

Technically, DHCP clients send broadcast discovery messages from port 68 to DHCP servers listening on port 67. The communication is connectionless over UDP, as IP addresses are not yet assigned when clients begin this process. Key DHCP operations include Discover, Offer, Request, and Acknowledge, facilitating automatic and centralized network configuration. Since port 68 is reserved for client-side communication, it primarily receives offer and acknowledgment messages during this process.

These protocols reduce administrative overhead by eliminating the need to manually assign IP settings on each host. They also support features such as lease renewal, re-binding, and failover options, which aid in maintaining stable and scalable network environments. The reliance on broadcast traffic inherently limits DHCP communication within the local subnet unless relays or special configurations are employed.

Security Information

exposure of :68

risk score

4/ 10caution

worth attention. how exposed you are depends on configuration — don't leave it reachable from the internet without a reason.

network services averages 3.9 across 604 ports — this one sits 0.1 above.

in transit

cleartext

credentials and payloads are readable by anyone on path

assignment

official

registered with iana for this service — scanners fingerprint it by number

reachable over

udp

udp is connectionless — source addresses are trivially spoofed and it is a reflection favourite

security overview

Common Vulnerabilities:

  • Unauthorized DHCP Servers (Rogue DHCP): Attackers can set up rogue DHCP servers to hand out malicious configuration, redirecting clients to malicious gateways or DNS servers.
  • DHCP Starvation Attacks: Flooding DHCP servers with bogus requests can exhaust the IP pool, leading to denial-of-service for legitimate clients.
  • Man-in-the-Middle Attacks: Exploiting DHCP responses can facilitate further attacks, such as intercepting or modifying client communication.

Common Mitigations:

  • Port Security and DHCP Snooping: Limit which switch ports can serve DHCP responses by enabling DHCP snooping on network switches to block responses from unauthorized servers.
  • Network Segmentation: Isolate untrusted devices through VLANs or separate subnets to contain potential threats.
  • Authentication: Implement IEEE 802.1X for client authentication before granting network access.
  • Monitoring and Logging: Regularly monitor DHCP activity logs for anomalous activity indicative of attacks.
  • IP Source Guard: Combine with DHCP snooping to prevent IP spoofing by filtering packets with invalid source addresses.

the 8 most looked-up other ports in network services — 604 ports carry that label.

risk mix of the 8 listed

  • caution100%

0 of 8 encrypted