Port 389 — LDAP

Q: How can this port be checked?

For TCP, Windows can test connectivity with Test-NetConnection SERVER -Port 389. On Linux, nc -vz SERVER 389 checks the TCP connection. An LDAP StartTLS test can be added when encrypted LDAP on 389 is expected.

TopicActive Directory →

⌚ About 2 min read

View my favorites

Port389

TransportTCP/UDP

ServiceLDAP

Port 389TCP/UDP

LDAP directory access, especially in Active Directory environments.

What is Port 389 used for?

Directory services. The protocol or service commonly associated with this port is LDAP.

Role and operation

TCP 389 is commonly used for LDAP operations such as binding, searching, and modifying directory objects. In Active Directory, UDP 389 can also be used for selected domain-controller discovery exchanges (CLDAP). LDAP on port 389 can be protected with StartTLS when clients and servers are configured accordingly.

Transport protocol

TCP/UDP

Security precautions

Avoid unprotected simple LDAP authentication across untrusted networks. Use TLS for sensitive exchanges, apply the directory-signing requirements appropriate to the environment, and restrict access to the required directory servers.

Should this port be opened in the firewall?

Open 389 only between clients or applications that need LDAP and the relevant directory servers. Do not expose an enterprise directory directly to the Internet without a dedicated security architecture.

How can this port be checked?

For TCP, Windows can test connectivity with Test-NetConnection SERVER -Port 389. On Linux, nc -vz SERVER 389 checks the TCP connection. An LDAP StartTLS test can be added when encrypted LDAP on 389 is expected.

Port-to-service mappings are common conventions. An application may be configured on another port or use a different transport depending on its implementation.