I've just stumbled upon something pretty weird, at least for me at this moment.
When i've finished setting up my openBSD 5.5 server, along with the isc-dhcp43-server port. I tried to see if i could find this service by doing a nmap-scan from a client.
But somehow the command listed below fails to find the open port (67), although the service is actually and providing ip-addresses.

Am i missing something here?

sudo nmap -Pn -p1-1024 [ip-address]

EDIT: I've also tried to scan the server using the -sU parameter, but even then it returns that the host is down. So i think it's safe to imply that finding a dhcp server does require to send out a dhcp-request packet, and that just port scanning doesn't suffice.

sudo nmap -Pn -sU -p1-1024 [ip-address]

Upon digging a bit deeper, i read that nmap should be able to send a dhcp-discover packet.

sudo nmap -Pn -sU -p1-1024 --script=dhcp-discover [ip-address] -vv

But on my system this returns the following error.
Unknown datalink type 138.

I will investigate this further tomorrow!


You're performing a SYN scan (the default when run as root) which only scans for TCP services. DHCP, on the other hand, is a UDP service, so will only be found with a UDP scan (-sU). Even then, it might not be found, as it is up to each application to respond to UDP packets, if it does not, then there will also be no response. This will lead to nmap giving the response "open|filtered", which means basically "the packet was not rejected". Alternatively, if an ICMP port unreachable message is received in response, nmap will mark the port "closed". Only if a response from the application is received (which most DHCP servers will not give to a UDP scan) will you get "open". See the NMAP documentation for details on port scanning techniques.

  • So that basicly means an dhcpd server can't be detected by just port scanning, but requires being able to send a dhcp-request packet. Nice to know! :)
    – D Jake
    Nov 1 '14 at 15:03
  • @DJake Lots of UDP services are like this, which is why Nmap sends appropriate payloads when possible during the port scan, in order to elicit a response: nmap.org/book/nmap-payloads.html Nov 2 '14 at 12:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.