Subnet and PortsNetwork service ports: DNS 53, DHCP 67 and 68, NTP 123, SNMP 161, LDAP 389
What the IANA registry records for these ports, and how to use them safely.
What IANA records
| Port | Protocols | Registered name | IANA description | Assignee | Reference | Note |
|---|---|---|---|---|---|---|
| 53 | tcp, udp | domain | Domain Name Server | Paul Mockapetris | n/a | |
| 67 | tcp, udp | bootps | Bootstrap Protocol Server | Bill Croft | [RFC 951] | Defined TXT keys: None |
| 68 | tcp, udp | bootpc | Bootstrap Protocol Client | Bill Croft | n/a | |
| 123 | tcp, udp | ntp | Network Time Protocol | Dave Mills | [RFC 5905] | |
| 161 | tcp, udp | snmp | SNMP | n/a | n/a | |
| 389 | tcp, udp | ldap | Lightweight Directory Access Protocol | Tim Howes | n/a |
What each one does
- 53, DNS turns names into addresses. It uses UDP for most questions and TCP for larger answers and zone transfers.
- 67 and 68, DHCP gives devices their addresses. A server listens on 67 (registered as
bootps) and clients use 68 (bootpc). - 123, NTP keeps clocks right. Correct time matters for logs, certificates and logins.
- 161, SNMP lets management tools read the status of network devices. Older versions use only a shared "community" string as a password.
- 389, LDAP is a directory service used for logins and address books. Its encrypted version uses a different port (636).
Safe habits
- Do not run an open DNS resolver or open NTP or SNMP server on the internet. Attackers use them to reflect and amplify traffic, and SNMP can leak details of the network.
- Use SNMP version 3 with authentication and encryption where possible; change default community strings.
- Restrict DHCP to your own network. A rogue DHCP server hands out wrong addresses and can redirect traffic.
- Use encrypted LDAP (LDAPS or STARTTLS) for anything that carries passwords.
- Point your devices at trusted time sources.
Troubleshooting pointers
- A device with an address starting 169.254 did not get an answer from DHCP.
- Names that do not resolve but addresses that work point to a DNS problem.
- Certificates that "are not yet valid" or "expired" on a device with the wrong date point to a clock problem.
This is an independent guide. It is not connected with IANA, the IETF or any network equipment maker. Address and port data come from the IANA registries as fetched on 14 November 2026; RFC texts were read from rfc-editor.org. Check the originals for anything you rely on.