UDP Port 67 – DHCP Server (Dynamic Host Configuration Protocol)

About UDP Port 67

The Internet Assigned Numbers Authority (IANA) registers port 67 for bootps. The IANA description reads: ‘Bootstrap Protocol Server’. This port appears in 8 IDS rules and does not have notable malware activity indicators in our data.

IDS Rule References

8 IDS / security rules reference UDP port 67. Presence in IDS rules does not mean traffic on this port is malicious. These are patterns security tools monitor.

Rule categories (top 4): attempted-admin (3), attempted-user (2), misc-activity (2), misc-attack (1).

Sample rule descriptions for UDP port 67:

• SERVER-OTHER bootp hardware address length overflow
• SERVER-OTHER bootp invalid hardware type
• SERVER-OTHER bootp hostname format string attempt
• OS-OTHER Malicious DHCP server bash environment variable injection attempt
• OS-LINUX Red Hat NetworkManager DHCP client command injection attempt

Data Sources

This information is compiled from: IANA Service Name and Transport Protocol Port Number Registry, Emerging Threats Open Ruleset (BSD 2-Clause / GPLv2 per SID range), and Snort Community Rules (GPLv2).