# WHATPORT(88)

## NAME

port 88 — Kerberos — The Kerberos KDC — where clients get tickets, and the heartbeat of every Active Directory domain.

Protocol: TCP/UDP  
IANA registry

## DESCRIPTION

A Key Distribution Center listens on 88 and answers AS-REQ and TGS-REQ messages, handing out the ticket-granting ticket and then service tickets that authenticate users without sending passwords. Windows domain controllers, MIT krb5 KDCs, Heimdal, and FreeIPA all listen here; Windows clients try UDP first and fall back to TCP when the ticket exceeds the datagram size. On a scan, an open 88 next to 389 and 445 is a domain controller, full stop. macOS also ships a KDC for local Kerberos realms.

## EXPOSURE

**Do not expose.** The KDC is the root of trust for the whole realm, and an exposed one invites offline password cracking via AS-REP roasting and pre-auth probing. Keep it internal or behind a VPN.

## CHECK

```sh
nc -vz TARGET 88
```

## SEE ALSO

- spec — [RFC 4120 — The Kerberos Network Authentication Service (V5)](https://www.rfc-editor.org/rfc/rfc4120.html) (rfc-editor.org)
- docs — [MIT Kerberos (official project site)](https://web.mit.edu/kerberos/) (web.mit.edu)
- source — [MIT Kerberos source repository](https://github.com/krb5/krb5) (github.com)
- iana — [IANA Service Name and Transport Protocol Port Number Registry](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml) (iana.org)

---

HTML: <https://whatport.net/88/> · JSON: <https://whatport.net/88.json> · full dataset: <https://whatport.net/ports.json>