whatportis.com
suggest an edit →

Port 3868Diameter Protocol

Diameter is an Authentication, Authorization, and Accounting (AAA) protocol defined in RFC 3588, and a successor to RADIUS. It is used primarily in modern IP-based networks for carrying authentication, service authorization, and configuration information, especially within mobile networks and LTE infrastructure..

inSecurityNetwork ServicesMobile
transport
tcp · sctp

2 transports registered

in transit
cleartext

payload readable on path

assignment
official

registered with iana

risk
4/10

caution

lookups
7,659

rank 667 of 993 · top 67%

Technical Details

what runs on :3868

Diameter is a protocol designed to provide scalable AAA services in IP-based networks. Its design overcomes many limitations of its predecessor, RADIUS, including improved transport reliability, failover mechanisms, and enhanced security capabilities. Functionally, Diameter supports message routing, proxying, and redirect services, facilitating communication between diverse network entities in a flexible manner.

Diameter operates primarily over TCP or SCTP, aiming to ensure reliable data delivery rather than the unreliable transport used by RADIUS. The protocol defines a base message structure with extensible commands using Attribute-Value Pairs (AVPs), allowing it to be adapted for new applications without breaking backward compatibility. This extensibility makes Diameter suitable for a variety of AAA scenarios, from LTE core network functions (like S6a interface) to IMS implementations.

In mobile networks, Diameter functions as a fundamental signaling protocol handling subscriber profile management, mobility management, charging, and policy control. Interfaces that rely on Diameter facilitate communication across Home Subscriber Servers (HSS), Policy Charging Rules Functions (PCRF), and other critical infrastructure elements, ensuring consistent subscriber experiences and seamless roaming.

Security Information

exposure of :3868

risk score

4/ 10caution

worth attention. how exposed you are depends on configuration — don't leave it reachable from the internet without a reason.

security averages 3.8 across 216 ports — this one sits 0.2 above.

in transit

cleartext

credentials and payloads are readable by anyone on path

assignment

official

registered with iana for this service — scanners fingerprint it by number

reachable over

tcp · sctp

every listening transport is another surface to filter at the edge

security overview

Common vulnerabilities:

  • Denial of Service (DoS) attacks targeting open Diameter ports to exhaust network or device resources.
  • Interception risks due to lack of default encryption, potentially compromising sensitive subscriber data.
  • Misconfigurations or poor access controls enabling unauthorized message injection, replay, or manipulation.
  • Exploitation of protocol extensions or poorly implemented AVP validations leading to service disruptions or data leaks.

Common mitigations:

  • Deploying Diameter over Secure SCTP channels or encapsulating Diameter within IPSec tunnels to ensure data confidentiality and integrity.
  • Implementing robust firewall rules and ingress filtering to limit open access to trusted network segments.
  • Utilizing message authentication and AVP validation to prevent spoofing and replay attacks.
  • Enabling detailed logging and real-time monitoring of Diameter traffic to detect anomalies quickly.
  • Regularly updating and patching Diameter-capable network equipment in line with vendor security advisories.

Related Ports

all 216 in security →

the 8 most looked-up other ports in security — 216 ports carry that label.

portservicerisk
:8881Atlasz Secure Servercaution
:443HTTPScaution
:8291Winbox MikroTik Admincaution
:3268Microsoft Global Catalog (GC)caution
:135Microsoft EPMAPcaution
:3128Squid Proxy HTTPcaution
:8080HTTP Alternatecaution
:7000Vuze HTTPS Trackercaution

risk mix of the 8 listed

  • caution100%

3 of 8 encrypted