What are ports 67 and 68 used for?
Ports 67 and 68 are DHCP, the service that hands out IP addresses and network settings automatically. The server listens on 67 and the client on 68.
The exchange has four steps, discover, offer, request and acknowledge, often remembered as DORA. Because it starts as a broadcast, it does not cross a router on its own; a relay agent (the IP helper setting on a router) forwards requests from other subnets to the server. A client that gets no answer assigns itself a 169.254.x.x address, which is the usual sign that DHCP is unreachable. DHCP has no authentication, so any device can answer: a rogue DHCP server can hand out a false gateway or DNS server.
Are ports 67 and 68 TCP or UDP?
UDP. A client that has no address yet cannot open a TCP connection, so DHCP uses UDP broadcasts: the client sends from port 68 to port 67, and the server answers from 67 to 68.
Is DHCP on ports 67 and 68 secure?
DHCP itself has no authentication or encryption. Networks protect it at the switch with DHCP snooping, which only lets DHCP offers come from trusted ports, so a rogue server plugged into an access port is ignored.
Port 67 vs port 68: what is the difference?
Direction. Port 67 is the server side and port 68 is the client side. Requests go to 67 and replies go to 68, so a firewall rule for DHCP has to allow both.
Which CompTIA exams list ports 67 and 68?
CompTIA lists ports 67 and 68 by number in both the Network+ and the A+ Core 1 objectives.
- Network+ N10-009: objective 1.4 (Networking Concepts), listed as “Dynamic Host Configuration Protocol (DHCP), 67/68”.
- A+ Core 1 220-1201: objective 2.1 (Networking), listed as “67/68, Dynamic Host Configuration Protocol (DHCP)”.
The quoted text is how the objectives document lists the port. The exam puts the port in a scenario, such as a firewall rule or a failed connection; it does not only ask for the number.
Check yourself: a practice question
Written by CertSprint for this page. It is not taken from any exam.
PCs on a new subnet get 169.254.x.x addresses, while PCs on the DHCP server's own subnet are fine. What is most likely missing?
- A DHCP relay agent on the new subnet's router
- A DNS record for each PC
- An open TCP 443
- A longer lease time
Show the answer
A. A DHCP relay agent on the new subnet's router. DHCP discovery is a broadcast and stops at the router. A relay agent forwards it to the server; without one, clients on other subnets fall back to self-assigned addresses.
Sources: IANA Service Name and Transport Protocol Port Number Registry: port 67; RFC 2131: Dynamic Host Configuration Protocol; RFC 3927: Dynamic Configuration of IPv4 Link-Local Addresses. The port number and how each exam lists it come from CompTIA's exam objectives, linked from the study plans above. The explanation and the question are CertSprint's own, checked against these sources on 12 November 2026.