546

Port 546/tcp is registered with IANA as dhcpv6-client with the description "DHCPv6 Client," but the critical transport detail is that this TCP row is essentially a placeholder with blank assignee and reference, while the UDP sibling 546/udp carries the assignee IESG (IETF Chair) and reference [RFC9915] with a modification date of 2018-05-21. It is the client side of DHCPv6 — IPv6 hosts obtaining addresses, prefixes, and configuration. DHCPv6 is defined by RFC 8415 (November 2018, which obsoletes the original RFC 3315 of 2003; the registry now points at RFC 9915, the latest revision), and it runs over UDP, not TCP: clients listen on UDP 546 and servers/relays on UDP 547, with clients multicasting Solicit to All_DHCP_Relay_Agents_and_Servers (ff02::1:2). The message flow is Solicit → Advertise → Request → Reply (or a two-message rapid-commit), using Identity Associations — IA_NA for addresses, IA_PD for prefix delegation — keyed by DUID and IAID, complementing SLAAC. The TCP/546 registration is effectively unused. The IANA reference on the TCP row is blank (the UDP row cites [RFC9915]). Security-wise the marquee risk is rogue DHCPv6 and the mitm6 attack: even IPv4-only Windows networks send DHCPv6 solicits because Windows prefers IPv6, so an attacker running mitm6 (Fox-IT / dirkjanm) answers as a rogue DHCPv6 server, assigns itself as the victim's IPv6 DNS server, and then — with ntlmrelayx from Impacket plus WPAD spoofing — relays NTLM authentication to a domain controller and can pivot to full Active Directory compromise via Resource-Based Constrained Delegation; mitigations include DHCPv6 Guard / RA Guard, blocking inbound DHCPv6 and Router Advertisements via Windows Firewall GPO, setting ms-DS-MachineAccountQuota to 0, and enforcing LDAP/SMB signing. For an analyst, real DHCPv6 activity appears on UDP 546/547, so an open TCP/546 is unusual; the actionable signal is rogue-DHCPv6/mitm6 risk on the segment.

IANA assignment

dhcpv6-client — "DHCPv6 Client"; reference (blank on the TCP row — the UDP row cites [RFC9915]); assignee blank on TCP row (UDP row: IESG); modification 2018-05-21 (UDP row); dual-registered 546/tcp + 546/udp (UDP is the operational transport)

[IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

nmap-services open-frequency 546/tcp ~0.000000 (de-facto; DHCPv6 is UDP) [Well-established] — nmap-services file

Related ports

547 (dhcpv6-server), 67/68 (DHCPv4 bootps/bootpc)

Primary use

DHCPv6 client — IPv6 address/prefix/config acquisition (RFC 8415)

Other/unofficial uses

none; TCP/546 effectively unused [Well-established]

Security implications

rogue DHCPv6 / mitm6 — attacker becomes IPv6 DNS server and relays NTLM to a DC (RBCD → AD compromise); mitigate via DHCPv6/RA Guard, Windows Firewall GPO, MachineAccountQuota=0, LDAP/SMB signing

Typically seen on

IPv6 hosts/clients (the listener); real traffic is UDP

Analyst note

Real DHCPv6 activity appears on UDP 546/547; an open TCP/546 is unusual. The actionable signal is rogue-DHCPv6/mitm6 risk on the segment.

Port 546/udp carries the DHCPv6 client, the protocol a host uses to request IPv6 addressing and network configuration from a DHCPv6 server or relay agent; it operates on the local link and should stay internal-only rather than being exposed to the public internet.

IANA registers 546/udp as dhcpv6-client ("DHCPv6 Client"), assigned to the IESG (Internet Engineering Steering Group), with reference RFC 9915 and a modification date of 2018-05-21. The original DHCPv6 specification, RFC 3315, was obsoleted by RFC 8415, which was in turn obsoleted by RFC 9915 — the current specification. The same service name is also registered on 546/tcp, but that TCP row carries a blank assignee and blank reference field, unlike the fully populated UDP entry.

A DHCPv6 client sends unicast or multicast requests from source port 546 to destination port 547, where servers and relay agents listen — pairing 546/udp with 547/udp much as legacy DHCP pairs 68/udp with 67/udp. The exchange configures IPv6 addresses, delegated prefixes, and options such as DNS servers automatically, so this traffic is expected only on local subnets, never as a service reachable from the wider internet.

No specific client-side implementation could be confirmed by citation as binding to this port; the corresponding servers and relays (ISC Kea, Windows Server DHCPv6, vendor router/firewall DHCPv6 relay features) listen on 547/udp instead.

Exposure

DHCPv6 client traffic is local-link by design; a publicly reachable 546/udp is anomalous and should be treated as misconfiguration or scan noise rather than legitimate service exposure.

Primary risk

rogue or spoofed DHCPv6 servers/relays handing clients malicious IPv6 configuration, rather than direct exploitation of the client port itself.

Overblocking risk

firewalling 546/547 too aggressively can break automatic IPv6 address assignment on a network.

Malware association

none found; auditmypc.com's port-546 page carries no virus/trojan flag as of an August 2026 check.

Scanning activity

SANS ISC's port-546 activity page showed no populated attack-statistics or top-scanner data as of an August 2026 search.

IANA assignment

dhcpv6-client — "DHCPv6 Client"; reference RFC 9915; assignee IESG (Internet Engineering Steering Group); modification date 2018-05-21 [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry dhcpv6-client 546/udp

Dual registration

also registered on 546/tcp under the same service name and description, but that TCP row has a blank assignee and blank reference field [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry dhcpv6-client 546/tcp

Range class

well-known/system (0–1023) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry dhcpv6-client 546/udp

Prevalence

nmap-services open-frequency 546/udp ≈ 0.00084 (~0.084%); 546/tcp ≈ 0 (sampled, not observed open) [Confirmed] — this site's own tooling

Related ports

547/udp (DHCPv6 server/relay); legacy analog 67/udp + 68/udp (DHCP for IPv4) [Confirmed] — https://datatracker.ietf.org/doc/html/rfc8415

Primary use

DHCPv6 client side of RFC 9915 (the current DHCPv6 specification, which obsoletes RFC 8415, which in turn obsoleted RFC 3315); client sends from 546/udp to a server/relay on 547/udp to obtain IPv6 addresses and configuration

Other/unofficial uses

none documented beyond the standard DHCPv6 client role [Unknown]

Security implications

local-link-only protocol; risk centers on rogue DHCPv6 servers/relays rather than the client port itself; no malware association found as of an August 2026 check [Likely] — https://www.auditmypc.com/udp-port-546.asp, https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_Gaia_Advanced_Routing_AdminGuide/Topics-GARG/IPv6-DHCP-Relay-Security-Policy.htm

Typically seen on

any IPv6-enabled host acting as a DHCPv6 client, on local subnets; not expected on internet-facing hosts

Common applications

none confirmed — no citation names specific client implementations for this port [Unknown]

Analyst note

A publicly reachable 546/udp is not expected — DHCPv6 client traffic should stay on the local link, so external exposure is more likely scanning noise or misconfiguration than a legitimate service.