Port reference
Port 547 (UDP) – DHCPv6 Server
DHCPv6 server — assigns IPv6 addresses and network options to clients on a link.
Quick facts
- Transport
- udp
- Category
- Well-known
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open on DHCPv6 servers and relays. IPv6 is enabled by default on Windows, leaving clients receptive to rogue DHCPv6 even where it is unused.
What is port 547 used for?
Port 547 (UDP) is the DHCPv6 server port. On IPv6 networks, DHCPv6 servers and relays listen here to hand out IPv6 addresses along with network options like DNS servers and domain search lists, while clients reply from UDP 546. It is the IPv6 counterpart to IPv4 DHCP on ports 67 and 68, and is provided by software such as the Windows Server DHCP role, ISC Kea and dhcpd, and the dnsmasq service on Linux routers.
When would you open it?
Open UDP 547 only on the machine acting as your DHCPv6 server or relay, so it can receive address requests from clients on the same link. On home and office networks this usually lives on the router or a dedicated server; ordinary client devices never need it opened inbound.
Is it safe to open?
The main risk is a rogue DHCPv6 server handing out malicious settings, so restrict it to your authorized server and use switch features like DHCPv6 Guard to block impostors. See the security notes below.
How to check if this port is open
ss -tulpn | grep :547
nmap -sU -p 547 <target>netstat -ano | findstr :547
Test-NetConnection <host> -Port 547 # TCP onlylsof -i :547
nmap -sU -p 547 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 547 to your device's local IP, internal port 547, protocol UDP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 547/udpsudo firewall-cmd --permanent --add-port=547/udp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p udp --dport 547 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 547" -Direction Inbound -Protocol UDP -LocalPort 547 -Action AllowSecurity & risks
Common attacks
- Rogue DHCPv6 server hijacking client IPv6 configuration
- mitm6 — DNS takeover via DHCPv6 to relay NTLM in Active Directory
- DNS server option injection to redirect resolution
- Denial of service through address-pool exhaustion
Hardening
- Disable IPv6 or DHCPv6 on clients where it is not used
- Enable DHCPv6 Guard / RA Guard on switch ports
- Enforce LDAP signing and channel binding to neutralise mitm6 relay
- Restrict DHCPv6 to authorised servers and monitor for rogue responders
- Segment and inspect IPv6 traffic, not just IPv4
How to block this port
sudo ufw deny 547/udpsudo firewall-cmd --permanent --remove-port=547/udp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p udp --dport 547 -j DROPNew-NetFirewallRule -DisplayName "Block 547" -Direction Inbound -Protocol UDP -LocalPort 547 -Action Blocknmap snippet
nmap -6 -sU -p547 --script dhcp6-discover <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What is port 547 used for?
- Port 547 is the DHCPv6 server port. Servers and relays listen on UDP 547 to hand out IPv6 addresses, DNS servers, and other network options to clients (which use port 546).
- Why is DHCPv6 dangerous in Active Directory?
- Windows prefers IPv6, so a rogue DHCPv6 server (mitm6) can become the client's DNS server, redirect authentication, and relay NTLM to LDAP for domain takeover.