What are UDP ports 67 and 68 for, and why does DHCP use broadcast addresses for some packets?

Port 67 = DHCP server, Port 68 = DHCP client. Broadcasts are used because the client doesn't yet have an IP, so it can't address anyone directly.

The port assignment:

Most protocols use one well-known port + ephemeral source ports. DHCP is unusual — it uses two well-known ports so that BOTH sides can send and receive without requiring source-port preservation through forwarding.

The broadcast addresses:

Source IP:    0.0.0.0      (no IP yet!)
Dest IP:      255.255.255.255 (broadcast — everyone)
Source MAC:   client's MAC
Dest MAC:     ff:ff:ff:ff:ff:ff (Ethernet broadcast)

Why broadcast is necessary:

In step 1 (DISCOVER), the client has no IP, doesn't know its subnet, doesn't know the server's address. The only way to reach "any device on this LAN" is broadcast.

Why UDP, not TCP:

• TCP requires both sides to have IPs and ports → impossible during initial bootstrap
• UDP is connectionless — fits a "shout into the void" model
• DHCP messages are small and self-contained → no benefit from streams or retransmit logic
• Built-in retransmit is handled at the DHCP level, not transport

A handy hint:

You can filter Wireshark with dhcp (newer) or udp.port==67 || udp.port==68 (works in older versions or with non-DHCP traffic on these ports).

Tip: DHCP relays (ip helper-address on Cisco) forward broadcasts across subnets, allowing one DHCP server to serve multiple VLANs. Without them, every subnet would need its own DHCP server.

Go deeper:

• Dynamic Host Configuration Protocol (Wikipedia) — the server-67/client-68 split and the broadcast for DISCOVER.
• RFC 2131 — DHCP — the spec mandating the two well-known ports and broadcast bootstrap.