Port 88 — TCP/UDP
Kerberos authentication, notably in Active Directory environments.
What is port 88 used for?
Kerberos exchanges between clients and a KDC to obtain authentication and service tickets.
Transport protocol
TCP/UDP
Role and operation
The client contacts the KDC on port 88 for AS and TGS exchanges. UDP can be used for some messages, while TCP is used when messages are too large or when the client selects it. In Active Directory, DNS and time synchronization are also essential to Kerberos operation.
Security precautions
This is a critical domain service. Do not expose it directly to the Internet and restrict traffic to authorized networks, domain controllers, and clients.
Should this port be opened in the firewall?
Allow TCP and/or UDP 88 according to actual client and KDC requirements, and do not assume that a TCP-only test validates Kerberos as a whole.
How to verify this port
Test-NetConnection SERVER -Port 88 validates TCP connectivity only. To validate Kerberos, perform a real authentication and use tools such as klist, KDC logs, and, when needed, a packet capture to confirm TCP/UDP 88 exchanges.
Port/service mappings are common conventions. An application can be configured to use a different port.