# WHATPORT(50389)

## NAME

port 50389 — Unassigned (dynamic range) — offset LDAP in practice — Unregistered, but the number is LDAP's 389 plus a 50000 offset, which is how unprivileged directory servers are usually run.

Protocol: TCP  
IANA registry

## DESCRIPTION

There is no IANA assignment for 50389; RFC 6335 puts it in the Dynamic/Private range. What the number does encode is a common convention: a directory server running as a non-root user cannot bind 389, so deployments shift the standard LDAP pair by a fixed offset — the same trick ApacheDS ships by default with 10389 and 10636. An open 50389 alongside 50636 is a strong hint of an offset LDAP/LDAPS pair, but it is a hint, not an assignment, and an LDAP search is the way to confirm it.

## EXPOSURE

**Do not expose.** If it is LDAP, it is a cleartext directory service carrying simple-bind credentials and your whole identity tree; keep it internal and use the TLS port.

## CHECK

```sh
ldapsearch -x -H ldap://TARGET:50389 -s base -b '' namingContexts
```

## SEE ALSO

- spec — [RFC 4511 — Lightweight Directory Access Protocol (LDAP): The Protocol](https://www.rfc-editor.org/rfc/rfc4511.html) (rfc-editor.org)
- spec — [RFC 6335 — IANA Procedures for Service Name and Transport Protocol Port Number Registry](https://www.rfc-editor.org/rfc/rfc6335.html) (rfc-editor.org)
- iana — [IANA Service Name and Transport Protocol Port Number Registry](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml) (iana.org)

---

HTML: <https://whatport.net/50389/> · JSON: <https://whatport.net/50389.json> · full dataset: <https://whatport.net/ports.json>