Port reference
Port 88 (TCP/UDP) – Kerberos
Kerberos authentication — the ticket-granting protocol at the heart of Active Directory.
Quick facts
- Transport
- tcp, udp
- Category
- Well-known
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open on every Active Directory domain controller. Should never be exposed to the internet.
What is port 88 used for?
Port 88 carries Kerberos, the network authentication protocol that lets users and computers prove their identity without sending passwords across the network. It is best known as the heart of Microsoft Active Directory, where every domain controller listens on port 88 to issue login tickets. Kerberos is also used by non-Windows implementations such as MIT Kerberos and Heimdal, and by services like SSH, databases, and web apps configured for single sign-on. It runs over both UDP and TCP.
When would you open it?
You open port 88 when a host is acting as a Kerberos Key Distribution Center — typically an Active Directory domain controller or a Unix MIT/Heimdal KDC — and clients on the network need to authenticate against it. It only needs to be reachable on your internal, trusted network, never from the public internet, and only on the machine actually running the KDC role.
Is it safe to open?
Kerberos is sensitive because it guards access to an entire domain, so keep it strictly internal — restrict it to your LAN or a VPN and never expose it online. See the security notes below.
How to check if this port is open
ss -tulpn | grep :88
nmap -p 88 <target>netstat -ano | findstr :88
Test-NetConnection <host> -Port 88lsof -i :88
nmap -p 88 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 88 to your device's local IP, internal port 88, protocol TCP/UDP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 88/tcpsudo firewall-cmd --permanent --add-port=88/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 88 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 88" -Direction Inbound -Protocol TCP -LocalPort 88 -Action AllowSecurity & risks
Common attacks
- Kerberoasting of service account tickets
- AS-REP roasting of accounts without pre-authentication
- Golden and silver ticket forgery
- Pass-the-ticket and overpass-the-hash
Hardening
- Use long, random passwords for service accounts (gMSA where possible)
- Require Kerberos pre-authentication on all accounts
- Rotate the krbtgt account password regularly (twice)
- Monitor for anomalous TGS requests and encryption downgrades (RC4)
- Never expose 88 to the internet — keep DCs internal
How to block this port
sudo ufw deny 88/tcpsudo firewall-cmd --permanent --remove-port=88/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 88 -j DROPNew-NetFirewallRule -DisplayName "Block 88" -Direction Inbound -Protocol TCP -LocalPort 88 -Action Blocknmap snippet
nmap -p88 --script krb5-enum-users <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What is port 88 used for?
- Port 88 is the Kerberos authentication service used by Active Directory domain controllers to issue and validate authentication and ticket-granting tickets (TGTs).
- Why is Kerberos a target for attackers?
- Kerberos tickets can be cracked offline (Kerberoasting, AS-REP roasting) or forged (golden/silver tickets), letting attackers escalate privileges and persist across an AD domain.