Every time the dhcp service starts, it listens not only on but also on where PORT is a random number.

Anyone knows where this behaviour comes from?

root@OpenWrt:/# netstat -ntapue
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0  *               LISTEN      898/sshd
netstat: /proc/net/tcp6: No such file or directory
udp        0      0 *                           922/syslog-ng
udp        0      0 *                           1290/dhcpd
udp        0      0    *                           1290/dhcpd
udp        0      0  *                           974/tftpd-hpa
netstat: /proc/net/udp6: No such file or directory

My config is:

# dhcpd.conf

ddns-updates off;


# don't let clients modify their own A records
ignore client-updates;

default-lease-time 3600;
max-lease-time 86400;

option domain-name "lan";

option domain-name-servers,;

subnet netmask {
        host marvin
        { hardware ethernet 48:5D:11:2F:22:31;
        fixed-address; }
      option subnet-mask;
      option broadcast-address;
      option routers;
      deny unknown-clients;

      filename "pxelinux.0";
  • Does this port stay open? I would assume it uses some high-port to communicate with clients. – Bart De Vos Jul 21 '12 at 16:50
  • Whatever it means a "port stays open", the entry in netcat's output is still there. – dash17291 Jul 21 '12 at 18:01
  • That should be the port for mtftp for clients to download the bootfile. – lsmooth Jan 31 '13 at 17:40
  • This is related to Dynamic DNS but I don't have a detailed explanation yet. – dash17291 Jun 7 '13 at 10:40

Search in google returns that it's a kind of a bug:


On the launchpad there is also a link to the proposed solution (building package from source with extra options for ./configure script):


I have checked release notes for latest stable (4.2.5-P1) and development (4.2.6b1 and 4.3.0b1) versions of ISC DHCPD and this bug does not seem to be fixed there.

For OpenWRT to rebuild the package from source with custom options, you need to build your own opkg package using cross-compiler for your router's architecture, or even rebuild the whole OpenWRT image: http://wiki.openwrt.org/doc/devel/packages

So to solve the security issue I would suggest you to just block all ports except needed (22, 67, 69, 514) with your firewall.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.