Port reference
Port 3268 (TCP) – LDAP Global Catalog
Active Directory Global Catalog — a forest-wide, partial-attribute LDAP index served by domain controllers.
Quick facts
- Transport
- tcp
- Category
- Registered
- TLS
- Cleartext
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open on Active Directory domain controllers that hold the Global Catalog role. Internal to the AD environment.
What is port 3268 used for?
Port 3268 is the TCP port for the Active Directory Global Catalog, served over LDAP by Windows domain controllers that hold the Global Catalog role. While standard LDAP on port 389 covers a single domain, the Global Catalog provides a forest-wide index of every object across all domains, which is why apps like Microsoft Outlook/Exchange and many directory-aware tools query it to look users up quickly. Its encrypted (TLS) equivalent is port 3269.
When would you open it?
You allow 3268 within an Active Directory environment so domain controllers, Exchange servers, and applications that need forest-wide directory lookups can reach the Global Catalog. It stays on the internal network between trusted servers and domain controllers.
Is it safe to open?
The Global Catalog can reveal accounts, groups, and computers across the whole forest, so it should never face the internet. Prefer the TLS port 3269, disable anonymous binds, enforce LDAP signing, and keep it segmented internally. See the security notes below.
How to check if this port is open
ss -tulpn | grep :3268
nmap -p 3268 <target>netstat -ano | findstr :3268
Test-NetConnection <host> -Port 3268lsof -i :3268
nmap -p 3268 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 3268 to your device's local IP, internal port 3268, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 3268/tcpsudo firewall-cmd --permanent --add-port=3268/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 3268 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 3268" -Direction Inbound -Protocol TCP -LocalPort 3268 -Action AllowSecurity & risks
Use a secure alternative
This is a legacy or cleartext protocol. Prefer the encrypted equivalent:
Common attacks
- Forest-wide user, group, and computer enumeration over LDAP
- Anonymous or low-privilege binds leaking directory data
- Reconnaissance for attack paths (BloodHound-style collection)
- Credential harvesting via attributes and weak LDAP/cleartext binds
Hardening
- Use the TLS Global Catalog port 3269 (LDAPS) and require signing/channel binding
- Disable anonymous LDAP binds; restrict who can read sensitive attributes
- Never expose 3268/3269 to the internet; segment and firewall domain controllers
- Monitor for bulk LDAP queries and BloodHound-style enumeration
- Apply least privilege and tier admin accounts in AD
How to block this port
sudo ufw deny 3268/tcpsudo firewall-cmd --permanent --remove-port=3268/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 3268 -j DROPNew-NetFirewallRule -DisplayName "Block 3268" -Direction Inbound -Protocol TCP -LocalPort 3268 -Action Blocknmap snippet
nmap -p3268 --script ldap-rootdse,ldap-search <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What is the difference between port 389 and port 3268?
- Port 389 is standard LDAP scoped to a single domain. Port 3268 is the Global Catalog — a forest-wide, partial-attribute index across all domains. Their TLS equivalents are 636 and 3269.
- Why is the Global Catalog a recon target?
- It lets a single query enumerate users, groups, and computers across the entire forest. Attackers use it (e.g. BloodHound) to map attack paths, so anonymous binds and over-broad read access are dangerous.