547
Summary
- // if you see it open
- An open UDP 547 marks a DHCPv6 server/relay and shares the rogue-server/mitm6 surface with 546 (a malicious 547 listener is what mitm6 impersonates to become the IPv6 DNS server and relay NTLM to a DC). Restrict DHCPv6-server traffic to trusted servers; deploy DHCPv6 Guard.
- // analyst note
- UDP 547 = legitimate DHCPv6 server/relay; TCP 547 = likely Bulk/Active Leasequery on carrier/enterprise gear. Consider rogue-DHCPv6 risk either way.
About port 547/tcp.
Port 547/tcp is registered with IANA as dhcpv6-server with the description "DHCPv6 Server," and notably the TCP row cites the reference [RFC5460] with assignee IESG and a modification date of 2018-05-21, while the UDP sibling 547/udp cites [RFC9915]. It is the server and relay-agent side of DHCPv6. In normal operation, servers and relay agents listen on UDP 547: relays forward client messages toward All_DHCP_Servers (ff05::1:3) and servers reply, and prefix delegation (IA_PD) lets an ISP or edge router hand a whole prefix to customer-premises equipment. The TCP/547 registration, however, has a genuine use that explains the [RFC5460] reference: DHCPv6 Bulk Leasequery (RFC 5460, February 2009) and Active Leasequery (RFC 7653, October 2015) open TCP connections to port 547 to bulk-transfer binding and lease data — used by relay agents, CMTS and broadband gear, and similar infrastructure. The IANA reference field on the TCP row is [RFC5460]. Security-wise an open UDP 547 marks a DHCPv6 server or relay and presents the same rogue-server and mitm6 threat surface as 546 — a malicious 547 listener is exactly what mitm6 impersonates to become a network's IPv6 DNS server and relay NTLM authentication — so DHCPv6-server traffic should be restricted to trusted servers and DHCPv6 Guard deployed. For an analyst, UDP 547 is a legitimate DHCPv6 server/relay, while TCP 547 is likely Bulk or Active Leasequery on carrier or enterprise gear; consider rogue-DHCPv6 risk either way.
- IANA assignment
dhcpv6-server— "DHCPv6 Server"; reference [RFC5460] on the TCP row (the UDP row cites [RFC9915]); assignee IESG; modification 2018-05-21; dual-registered 547/tcp + 547/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023)
- Prevalence
- nmap-services open-frequency 547/tcp ~0.000000 (de-facto; DHCPv6 is UDP) [Well-established] — nmap-services file
- Related ports
- 546 (dhcpv6-client), 67/68 (DHCPv4)
Primary use
DHCPv6 server/relay — IPv6 address/prefix assignment (RFC 8415); UDP 547 in practice
Other/unofficial uses
TCP/547 = DHCPv6 Bulk Leasequery (RFC 5460) / Active Leasequery (RFC 7653)
Security implications
rogue DHCPv6 server / mitm6 (same chain as 546 — IPv6 DNS takeover → NTLM relay → AD compromise); restrict to trusted servers; DHCPv6 Guard [Well-established/Threat-reported]
Typically seen on
DHCPv6 servers/relays (routers, ISP CPE, enterprise); CMTS/broadband for Leasequery
- Analyst note
- UDP 547 = legitimate DHCPv6 server/relay; TCP 547 = likely Bulk/Active Leasequery on carrier/enterprise gear. Consider rogue-DHCPv6 risk either way.
About port 547/udp.
Port 547/udp is registered with IANA as dhcpv6-server with the description "DHCPv6 Server," assignee IESG, contact IETF Chair, and a modification date of 2018-05-21; the registry's registration-date column is blank and the reference cites RFC 9915. It is the listener port for DHCPv6 servers and relay agents — the IPv6 counterpart to DHCPv4's 67/68 split. DHCPv6 (defined in RFC 9915, published 2026-01-30 as Internet Standard STD 102, which obsoletes RFC 8415 from November 2018, itself obsoleting the original RFC 3315 from July 2003) assigns IPv6 addresses, prefixes (prefix delegation), and parameters such as DNS resolvers to clients on a link. Clients source their requests from UDP 546 and send SOLICIT/REQUEST messages to the all-DHCP-relay-agents-and-servers multicast address ff02::1:2 on port 547; servers and relay agents bind to 547 to answer. The protocol supports stateful address assignment, prefix delegation, and stateless information-only modes. The same name is dual-registered on TCP (port 547/tcp, reference RFC 5460) for the DHCPv6 leasequery-over-TCP transport, but the UDP port carries ordinary DHCPv6 operation. For an analyst, port 547 is fundamentally link-local: DHCPv6 multicast does not traverse routers, so 547 is structurally invisible to internet-wide scanners (Shodan/Censys) and SANS ISC shows no recorded CVEs and no notable scanning volume as of mid-2026. The realistic threat is intra-LAN: a rogue DHCPv6 server on the same segment answering SOLICIT before the legitimate one can poison clients with malicious DNS resolvers or gateways (man-in-the-middle / DNS spoofing). Mitigations are layer-2: RFC 7610 DHCPv6-Shield (August 2015) restricts server messages to trusted switch ports, and most enterprise switches offer DHCPv6 snooping analogous to DHCPv4 DHCP snooping. Inbound UDP 547 from the WAN should be blocked at all perimeters; it is normal only on trusted internal segments where a DHCPv6 server is deployed.
- IANA assignment
dhcpv6-server— "DHCPv6 Server"; reference RFC 9915; assignee IESG; contact IETF Chair; modification date 2018-05-21; registration-date column blank; dual-registered 547/tcp (reference RFC 5460) [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023) [Confirmed]
- Related ports
- 546/udp (DHCPv6 client source port); 547/tcp (DHCPv6 leasequery over TCP, RFC 5460); contrast 67/68 (DHCPv4)
Primary use
DHCPv6 server and relay-agent listener port; servers/relay agents bind UDP 547, clients source from 546 and multicast to ff02::1:2
Common software
ISC Kea (primary open-source DHCPv4/DHCPv6 server), legacy ISC DHCP dhcpd, Microsoft Windows Server DHCP role, Cisco IOS/NX-OS, Juniper Junos; clients built into Linux/Windows/macOS/Android/iOS (source from 546)
Security implications
rogue-DHCPv6-server poisoning is the primary realistic threat (malicious DNS/gateway → MITM/DNS spoofing); mitigated by RFC 7610 DHCPv6-Shield (Aug 2015) and switch-level DHCPv6 snooping; RFC 8415 provides RKAP/Authentication option for Reconfigure/relay traffic
Typically seen on
internal network segments with a DHCPv6 server/relay; absent from the public internet by design
- Governing RFC
- RFC 9915 (2026-01-30, STD 102; obsoletes RFC 8415 Nov 2018, which obsoleted RFC 3315 Jul 2003) [Confirmed] — IETF datatracker
- Scanning exposure
- not a meaningful internet-scanning target — DHCPv6 is link-local multicast and does not route over the internet; SANS ISC port 547 shows no CVEs and no notable scanning volume as of mid-2026 (green) [Confirmed] — SANS ISC
- Analyst note
- An internet-facing open 547 is anomalous — legitimate DHCPv6 is link-local. Investigate WAN exposure; on internal segments, watch for unauthorized (rogue) DHCPv6 responders.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| dhcpv6-server | UDP | DHCPv6 Server | 0.08% |
| dhcpv6-server | TCP | DHCPv6 Server | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.