# WHATPORT(50636) ## NAME port 50636 — Unassigned (dynamic range) — offset LDAPS in practice — Unregistered, but 636 plus a 50000 offset — the TLS half of an unprivileged LDAP pair. Protocol: TCP ## DESCRIPTION 50636 has no IANA assignment because it sits in the Dynamic/Private range. The number mirrors LDAPS on 636 shifted by 50000, the same offset pattern that puts plain LDAP on 50389. Directory servers are routinely moved to unprivileged ports this way so they can run without root. Finding 50636 open, especially next to 50389, points at a directory server on unprivileged ports, and a TLS handshake plus a root-DSE query will confirm or refute it. ## EXPOSURE **Expose with care.** LDAPS at least encrypts the bind, but a directory service is still an identity store; expose it only to the systems that must authenticate against it. ## CHECK ```sh openssl s_client -connect TARGET:50636 -servername TARGET · JSON: · full dataset: