546

Port 546/tcp is registered with IANA as dhcpv6-client with the description "DHCPv6 Client," but the critical transport detail is that this TCP row is essentially a placeholder with blank assignee and reference, while the UDP sibling 546/udp carries the assignee IESG (IETF Chair) and reference [RFC9915] with a modification date of 2018-05-21. It is the client side of DHCPv6 — IPv6 hosts obtaining addresses, prefixes, and configuration. DHCPv6 is defined by RFC 8415 (November 2018, which obsoletes the original RFC 3315 of 2003; the registry now points at RFC 9915, the latest revision), and it runs over UDP, not TCP: clients listen on UDP 546 and servers/relays on UDP 547, with clients multicasting Solicit to All_DHCP_Relay_Agents_and_Servers (ff02::1:2). The message flow is Solicit → Advertise → Request → Reply (or a two-message rapid-commit), using Identity Associations — IA_NA for addresses, IA_PD for prefix delegation — keyed by DUID and IAID, complementing SLAAC. The TCP/546 registration is effectively unused. The IANA reference on the TCP row is blank (the UDP row cites [RFC9915]). Security-wise the marquee risk is rogue DHCPv6 and the mitm6 attack: even IPv4-only Windows networks send DHCPv6 solicits because Windows prefers IPv6, so an attacker running mitm6 (Fox-IT / dirkjanm) answers as a rogue DHCPv6 server, assigns itself as the victim's IPv6 DNS server, and then — with ntlmrelayx from Impacket plus WPAD spoofing — relays NTLM authentication to a domain controller and can pivot to full Active Directory compromise via Resource-Based Constrained Delegation; mitigations include DHCPv6 Guard / RA Guard, blocking inbound DHCPv6 and Router Advertisements via Windows Firewall GPO, setting ms-DS-MachineAccountQuota to 0, and enforcing LDAP/SMB signing. For an analyst, real DHCPv6 activity appears on UDP 546/547, so an open TCP/546 is unusual; the actionable signal is rogue-DHCPv6/mitm6 risk on the segment.

IANA assignment

dhcpv6-client — "DHCPv6 Client"; reference (blank on the TCP row — the UDP row cites [RFC9915]); assignee blank on TCP row (UDP row: IESG); modification 2018-05-21 (UDP row); dual-registered 546/tcp + 546/udp (UDP is the operational transport)

[IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

nmap-services open-frequency 546/tcp ~0.000000 (de-facto; DHCPv6 is UDP) [Well-established] — nmap-services file

Related ports

547 (dhcpv6-server), 67/68 (DHCPv4 bootps/bootpc)

Primary use

DHCPv6 client — IPv6 address/prefix/config acquisition (RFC 8415)

Other/unofficial uses

none; TCP/546 effectively unused [Well-established]

Security implications

rogue DHCPv6 / mitm6 — attacker becomes IPv6 DNS server and relays NTLM to a DC (RBCD → AD compromise); mitigate via DHCPv6/RA Guard, Windows Firewall GPO, MachineAccountQuota=0, LDAP/SMB signing

Typically seen on

IPv6 hosts/clients (the listener); real traffic is UDP

Analyst note

Real DHCPv6 activity appears on UDP 546/547; an open TCP/546 is unusual. The actionable signal is rogue-DHCPv6/mitm6 risk on the segment.