Port 88: Kerberos
Port 88 is Kerberos, the ticket-based authentication protocol behind Active Directory and MIT Kerberos logins. IANA assigns it on both TCP and UDP, and both are genuinely used: RFC 4120 requires a KDC to accept TCP requests on port 88 while clients may also use UDP.
| Port number | 88 |
|---|---|
| Service | Kerberos authentication |
| Protocol | TCP/UDP |
| Category | Authentication |
| Default encryption | No |
| IANA service name | kerberos |
| IANA transports | TCP, UDP |
| Used in practice | TCP, UDP |
Why does Kerberos use both TCP and UDP on port 88?
Kerberos began as a UDP protocol, because a ticket request and its reply are a single exchange with no need for a connection. RFC 4120 states that a KDC must accept TCP requests and should listen for them on port 88, while a client must support TCP and may use UDP.
The reason TCP became necessary is ticket size. A Kerberos ticket carries authorisation data, and in Active Directory that includes the user's group memberships in a Privilege Attribute Certificate. A user in many groups produces a ticket too large to fit a UDP datagram, which fragments or fails outright.
Microsoft documents a registry setting, MaxPacketSize, that controls when the Windows Kerberos client switches to TCP, and setting it to zero forces TCP always. Symptoms of getting this wrong are distinctive: authentication works for most users but fails for the ones in the most groups, or works on the LAN and fails over a VPN that drops fragmented UDP.
What else needs to be open for Kerberos to work?
Accurate time, first of all. Kerberos uses timestamps to defeat replay attacks and rejects tickets outside a tolerance window, five minutes by default. That makes NTP on UDP port 123 a hard dependency of authentication, which surprises people the first time a clock drift breaks every login at once.
Working DNS is the second dependency. Clients locate the KDC through SRV records, and service principal names are built from hostnames, so a name that does not resolve consistently produces authentication failures that look nothing like a DNS problem.
Then the companion ports: 464 for password changes, 749 for administration, and on an Active Directory controller LDAP on 389 or 636 and the Global Catalog on 3268 or 3269.
Which ports are related to port 88?
The port a reader usually needs next is the encrypted or plaintext twin of this one, so those are listed first rather than buried in a generic list.
| Port | Relationship | Why it matters |
|---|---|---|
| 464 | companion | kpasswd, where a Kerberos password change is submitted. Separate from authentication traffic. |
| 749 | companion | Kerberos administration, used by admin tooling to manage principals and policies on the KDC. |
| 389 | companion | LDAP. On an Active Directory domain controller, Kerberos on 88 and LDAP on 389 are almost always both in play. |
What commonly listens on port 88?
- Active Directory domain controllers, where the KDC is part of the domain controller role
- MIT Kerberos krb5kdc and Heimdal kdc on Unix
- FreeIPA and Samba Active Directory domain controllers
How do I check whether port 88 is open?
Port 88 carries TCP, so a connection either completes its handshake or it does not, which makes the check definitive.
| Question | Command | What to know |
|---|---|---|
| Is it open on a remote host? | nc -vz example.com 88 | A TCP handshake either completes or it does not, so netcat gives a definitive answer in one line. |
| Same check on Windows | Test-NetConnection example.com -Port 88 | Built into PowerShell. TcpTestSucceeded in the output is the answer; telnet is not installed by default on modern Windows. |
| What is listening locally? | ss -tlnp | grep ':88 ' | Lists the process bound to port 88 on Linux. On macOS use lsof -nP -iTCP:88 -sTCP:LISTEN, on Windows netstat -ano | findstr :88 |
| Is it open on a remote host? | sudo nmap -sU -p 88 example.com | UDP has no handshake, so there is nothing to complete. nmap infers the state from whether an ICMP port-unreachable comes back, needs root, and is slow and easy to misread. A silent port may be open, filtered, or simply not replying to a probe it does not recognise. |
| What is listening locally? | ss -ulnp | grep ':88 ' | Shows the UDP socket bound to port 88. This is the reliable way to answer the question, because you are asking the host itself rather than guessing from outside. |
Replace example.com with the host you are testing. A blocked port and a port with nothing listening on it look identical from the outside, so if a service should be running, check locally before blaming the firewall.
Frequently asked questions
Is port 88 TCP or UDP?
Both, and unusually both are really used. IANA assigns the kerberos service on TCP and UDP at port 88, and RFC 4120 requires a KDC to accept TCP requests on port 88 while allowing clients to use UDP. A firewall rule for a domain controller should permit both.
What is port 88 used for in Active Directory?
It is where clients talk to the Key Distribution Center to authenticate and obtain Kerberos tickets, which is the mechanism behind domain logon and single sign-on. Password changes go to port 464 instead, and directory lookups to LDAP on 389.
Why does Kerberos authentication fail only for some users?
Classically because their tickets are larger. In Active Directory a ticket carries group memberships, so a user in many groups can produce a ticket too big for a UDP datagram. Forcing the Kerberos client to use TCP, via the MaxPacketSize registry setting on Windows, is the standard fix.
What is port 88 used for?
Port 88 is Kerberos, the ticket-based authentication protocol behind Active Directory and MIT Kerberos logins. IANA assigns it on both TCP and UDP, and both are genuinely used: RFC 4120 requires a KDC to accept TCP requests on port 88 while clients may also use UDP.
Is port 88 secure?
Port 88 is not encrypted by default. Where possible, use an encrypted alternative or tunnel it over TLS or a VPN.
Should I open port 88 on my firewall?
Only if you specifically need Kerberos. Expose it to the smallest set of trusted sources, and never open database or Windows-service ports to the whole internet.