PORTCryptographically protectedIANA assigned
Port 88Kerberos
Port 88 is the port for Kerberos, the ticket-based authentication protocol used by Active Directory and many Unix environments. Clients contact the Key Distribution Center on a domain controller over UDP or TCP 88 to obtain tickets; Windows uses TCP by default because tickets are usually too large for UDP.
What port 88 is used for
When a user logs on to a domain-joined Windows machine, the machine contacts a domain controller on port 88 and asks the Key Distribution Center for a ticket-granting ticket (TGT). Later, to open a file share or a web application, it presents that TGT and asks for a service ticket, again on port 88. The service then accepts the ticket without ever seeing the password. This is single sign-on, and port 88 is its transport.
The same protocol runs FreeIPA, MIT Kerberos realms and Samba AD.
Related ports
| Port | Purpose |
|---|---|
| 88 TCP/UDP | Ticket requests (AS-REQ, TGS-REQ) |
| 464 TCP/UDP | Password changes (kpasswd) |
| 749 TCP | Kerberos administration (MIT kadmin; not used by AD) |
Kerberos also depends on DNS to find the KDC (_kerberos._tcp SRV records) and on NTP for time.
Security considerations
- Kerberos is designed for hostile networks. Tickets are encrypted with keys derived from account passwords, so seeing the traffic does not reveal credentials.
- Weak passwords remain the risk. Offline attacks against service tickets (Kerberoasting) succeed when service accounts have guessable passwords. Use long random passwords or group Managed Service Accounts, and prefer AES over RC4 encryption types.
- Keep 88 internal. Exposing a KDC to the internet invites username enumeration and password spraying.
How to check port 88
Is something listening locally? On Windows, open Command Prompt and run:
netstat -ano | findstr :88A line in the LISTENING state means a local program has bound port 88; the last column is its process ID (PID). Match the PID in Task Manager (Details tab) or with tasklist /fi "PID eq <pid>". On Linux or macOS the equivalent is ss -tulnp | grep :88 or lsof -i :88.
Can you reach it on a remote host? PowerShell's built-in connection test attempts a TCP handshake:
Test-NetConnection dc01.corp.example -Port 88TcpTestSucceeded : True means the remote system accepted a TCP connection on port 88. False means the port is closed, filtered by a firewall, or the host is unreachable; the output's ping result helps tell those apart.
See the netstat and Test-NetConnection records for the full option sets.
Check your current tickets on a domain-joined machine:
klistklist purge clears them; the next access re-authenticates through port 88.
Firewall considerations
Domain controllers need inbound TCP and UDP 88 from all domain members. Nothing else needs it inbound. Block it at the internet edge.
On Windows, inbound rules live in Windows Defender Firewall with Advanced Security (wf.msc). A rule allowing port 88 only takes effect on the profile (Domain, Private, Public) it is assigned to. The command-line equivalent is netsh advfirewall firewall add rule; see the netsh record.
Frequently asked questions
Why does Kerberos need accurate time?
Tickets and authenticators carry timestamps to prevent replay. If the client and KDC clocks differ by more than the allowed skew (five minutes in AD), authentication fails with KRB_AP_ERR_SKEW. See the NTP record for port 123.
What is port 464?
The Kerberos password-change service (kpasswd). Windows uses it when a user changes a password through a domain-joined machine.
TCP or UDP for Kerberos?
Both are supported. Windows Vista and later default to TCP because Active Directory tickets with group membership data exceed the UDP size limit. Older clients used UDP and fell back to TCP when the response was too large.