Port 88Kerberos
Port 88 (TCP and UDP) is Kerberos, the authentication protocol behind Active Directory sign-ins: clients ask a domain controller's Key Distribution Center for tickets here, and password changes go to port 464. A domain controller's port 88 should never be reachable from the internet. Separately, Xbox consoles list UDP 88 among the ports to open for Xbox network play.
- transport
- tcp · udp
- in transit
- cleartext
- assignment
- official
- risk
- 2/10
- lookups
- 9,964
2 transports registered
payload readable on path
registered with iana
safe
rank 471 of 6,669 · top 7%
also known as krb5, kerberos v5
Technical Details
what runs on :88Kerberos is a secure authentication protocol originally developed at MIT as part of Project Athena. It utilizes symmetric key cryptography and a trusted third-party Key Distribution Center (KDC) to authenticate users and services over insecure networks without transmitting passwords in plaintext. The KDC issues time-limited tickets to users, which can then be presented to access network services securely.
When a user initially logs in, their client requests a Ticket Granting Ticket (TGT) from the KDC's Authentication Service (AS). Upon successful authentication, the TGT is used to obtain service tickets from the Ticket Granting Service (TGS), which allows the user to access specific services without re-entering credentials repeatedly. This mechanism helps maintain both usability and security.
Port 88 serves as the default communication point for both the AS and TGS using TCP and UDP protocols. UDP is typically used for lightweight, quick communication such as ticket requests, whereas TCP is employed when larger messages or reliability are required, such as in cross-realm authentication or when packet sizes exceed UDP limits.
Ports alongside 88 on a domain controller
- 464 TCP/UDP: Kerberos password changes (kpasswd)
- 389 / 636: LDAP and LDAPS
- 3268 / 3269: Global Catalog and Global Catalog over TLS
Why both TCP and UDP
When a reply is too large for a UDP datagram, the KDC answers KRB_ERR_RESPONSE_TOO_BIG and the client retries over TCP. Users in many groups carry large tickets, so a firewall that passes only UDP 88 causes sign-in failures that look intermittent, often over VPNs. Windows can be made to use TCP from the start by setting the MaxPacketSize registry value to 1.
Xbox and UDP 88
Microsoft's list of ports for Xbox network play starts with UDP 88, alongside 3074, 53, 80, 500, 3544 and 4500. Opening UDP 88 on a home router for a console is routine and unrelated to Kerberos.
Security Information
exposure of :88risk score
2/ 10safe
routine exposure. this port is rarely the way in on its own — keep it patched and logged and move on.
security averages 2.9 across 446 ports — this one sits 0.9 below.
in transit
cleartext
credentials and payloads are readable by anyone on path
assignment
official
registered with iana for this service — scanners fingerprint it by number
reachable over
tcp · udp
udp is connectionless — source addresses are trivially spoofed and it is a reflection favourite
security overview
Common Vulnerabilities
- Pass-the-Ticket/Pass-the-Hash Attacks: Attackers with access to valid tickets or hashes can impersonate legitimate users.
- Kerberoasting: Attackers extract service tickets from memory to perform offline brute-force attacks on service account passwords.
- Weak or Reused Passwords: Easily guessable passwords compromise the security of the authentication system.
- Unencrypted Communication: If not properly secured, attackers may intercept or manipulate Kerberos traffic.
- Time-based Attacks: Since Kerberos relies on synchronized clocks, attackers may exploit clock skew or manipulate timestamps.
Common Mitigations
- Enforce Strong Password Policies: Use complex, unique passwords for all accounts involved in Kerberos authentication.
- Enable Pre-Authentication: This reduces effectiveness of brute-force attempts.
- Regularly Rotate and Monitor Service Account Credentials: Limits potential exposure time.
- Use Encryption: Enable and enforce secure encryption algorithms within Kerberos tickets and communication channels.
- Monitor for Anomalies: Utilize SIEM tools to detect suspicious ticket requests, unusual authentication patterns, or privilege escalations.
- Ensure Accurate Time Synchronization: Maintain consistent network time through reliable NTP servers to prevent replay attacks.
Exposure
- AS-REP roasting: accounts with Kerberos pre-authentication disabled hand out crackable password material to anyone who can reach port 88, with no credentials needed. Find those accounts, enable pre-authentication, and keep port 88 on domain controllers off the internet.
Related Ports
the 8 most looked-up other ports in security — 446 ports carry that label.
| port | service | risk | |||
|---|---|---|---|---|---|
| :8881 | Atlasz Secure Server | TCP | Web Services | caution | 67.6k |
| :443 | HTTPS | TCPtls | Web Services | caution | 65.9k |
| :8291 | Winbox MikroTik Admin | TCP | Security | caution | 62.9k |
| :3268 | Microsoft Global Catalog (GC) | TCPUDP | Security | caution | 54.6k |
| :135 | Microsoft EPMAP | TCPUDP | Security | caution | 51.9k |
| :3128 | Squid Proxy HTTP | TCP | Web Services | caution | 45.8k |
| :8080 | HTTP Alternate | TCP | Web Services | caution | 44.9k |
| :7000 | Vuze HTTPS Tracker | TCPtls | Security | caution | 28.9k |
risk mix of the 8 listed
- caution100%
2 of 8 encrypted