Port 389 — TCP/UDP
LDAP directory access, especially in Active Directory environments.
What is port 389 used for?
Directory services. The protocol or service commonly associated with this port is LDAP.
Role and operation
TCP 389 is commonly used for LDAP operations such as binding, searching, and modifying directory objects. In Active Directory, UDP 389 can also be used for selected domain-controller discovery exchanges (CLDAP). LDAP on port 389 can be protected with StartTLS when clients and servers are configured accordingly.
Transport protocol
TCP/UDP
Security precautions
Avoid unprotected simple LDAP authentication across untrusted networks. Use TLS for sensitive exchanges, apply the directory-signing requirements appropriate to the environment, and restrict access to the required directory servers.
Should this port be opened in the firewall?
Open 389 only between clients or applications that need LDAP and the relevant directory servers. Do not expose an enterprise directory directly to the Internet without a dedicated security architecture.
How can this port be checked?
For TCP, Windows can test connectivity with Test-NetConnection SERVER -Port 389. On Linux, nc -vz SERVER 389 checks the TCP connection. An LDAP StartTLS test can be added when encrypted LDAP on 389 is expected.
Port-to-service mappings are common conventions. An application may be configured on another port or use a different transport depending on its implementation.