3268

Port 3268/tcp is registered with IANA as msft-gc with the description "Microsoft Global Catalog," a blank assignee field, and a blank reference field (dual-registered on TCP and UDP at line 6488/6489 of the cached IANA registry CSV). In practice it carries LDAP queries scoped to the Global Catalog (GC) — a partial, read-only replica of every object across all domains in an Active Directory forest. Domain Controllers designated as GC servers listen on 3268 so that a single connection can resolve forest-wide questions (UPN-to-account resolution, Universal security-group membership, cross-domain searches) without separately binding each domain. This is the distinction analysts care about: standard LDAP on port 389 is domain-scoped, whereas 3268 is forest-scoped over a partial attribute set; the encrypted equivalent is 3269 (LDAPS over GC). The port is consumed not only by AD DS itself but by Exchange (Global Address List lookups), SharePoint, Skype for Business, and third-party LDAP-integrated tooling. From a security standpoint 3268 is exclusively internal corporate infrastructure and should never be internet-routable. An externally reachable host answering on 3268 is almost certainly an improperly firewalled Windows Domain Controller; if anonymous LDAP bind is permitted it leaks forest-wide users, groups, and OUs, making it an effective reconnaissance surface (BloodHound ingestors and ldapsearch-style enumeration commonly target the GC port). Default 3268 traffic is unencrypted, so on-path capture is a credential risk, and the port sits adjacent to broad AD-exploitation chains — CVE-2020-1472 (Zerologon, CVSS 10.0) and CVE-2021-42287 (Kerberos PAC bypass) target the Netlogon and Kerberos protocols rather than port 3268's LDAP listener directly, but the security community frames them as the surrounding risk context. Hardening guidance is uniform: block 3268 at the perimeter and restrict internal access to hosts that genuinely need GC queries. The IANA reference field is blank.

IANA assignment

msft-gc — "Microsoft Global Catalog"; reference (blank — no RFC cited in IANA registry); assignee blank; dual-registered 3268/tcp + 3268/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (cached CSV line 6488/6489)

Range class

registered (1024–49151)

Related ports

389 (LDAP), 636 (LDAPS), 3269 (GC over SSL/LDAPS), 88 (Kerberos), 445 (SMB)

Primary use

LDAP access to the Active Directory Global Catalog — forest-wide, partial-attribute, read-only directory searches served by DCs in the GC role

Common software

Microsoft AD DS (GC role on Windows Server DCs); also Exchange (GAL), SharePoint, Skype for Business, and third-party LDAP-integrated apps

Security implications

internal-only port; anonymous/weak LDAP bind enables forest-wide AD enumeration (recon); default traffic unencrypted (on-path credential capture risk; prefer 3269/LDAPS); associated AD-exploit CVEs CVE-2020-1472 (Zerologon) and CVE-2021-42287 target Netlogon/Kerberos, not port 3268's listener directly

Exposure/scanning notes

internet-reachable 3268 is a high-severity misconfiguration almost always indicating an exposed DC; indexed by Shodan/Censys; internal 3268 scanning is a standard AD-enumeration step in pen-testing (ldapsearch, BloodHound GC ingestors)

Typically seen on

internal Windows Server Domain Controllers in the GC role; an internet-facing 3268 is an anomaly / misconfiguration

Relationship to other ports

389 is domain-scoped LDAP; 3268 is forest-scoped GC LDAP; 3269 is the LDAPS/encrypted GC equivalent [Confirmed] — Microsoft MS-ADTS spec

Analyst note

Treat any externally exposed 3268 as a probable misconfigured Domain Controller and a forest-wide reconnaissance exposure; legitimate use is internal-only.

Port 3268/udp is registered with IANA as msft-gc with the description "Microsoft Global Catalog," dual-registered alongside 3268/tcp; the registry leaves the assignee, registration date, modification date, and reference fields blank. The Global Catalog is the Active Directory service that holds a partial, forest-wide replica of every object so that directory queries can span an entire forest rather than a single domain. When a Windows Server domain controller is promoted to be a Global Catalog server, it answers LDAP Global Catalog queries on TCP 3268 (and LDAPS Global Catalog queries on TCP 3269); Microsoft's own protocol documentation names TCP as the transport for these connections. The practical point for an analyst is that the UDP half of this registration is essentially inert: it follows the long-standing IANA convention of registering a service for both transports at once, but no software or protocol specification is known to drive Global Catalog traffic over UDP, so a real 3268/udp listener is not something you should expect to find. The security weight of port 3268 sits almost entirely on the TCP side, where Global Catalog LDAP is plaintext by default — exposing it beyond the internal network invites credential sniffing and directory enumeration of users, groups, organizational units, and overall forest structure, which is a recognized Active Directory reconnaissance technique. Best practice is to block 3268 at the perimeter on both transports and prefer LDAPS on 3269 for cross-forest queries internally. For UDP specifically, real-world exposure is negligible: treat a responsive 3268/udp as an anomaly worth investigating rather than a normal service, since the documented Global Catalog stack does not use it.

IANA assignment

msft-gc — "Microsoft Global Catalog"; reference (blank — no RFC cited in IANA registry); assignee blank; dual-registered 3268/tcp + 3268/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry, msft-gc,3268,udp,Microsoft Global Catalog rows)

Range class

registered (1024–49151)

Related ports

3269/tcp (LDAPS Global Catalog), 389 (LDAP), 636 (LDAPS), 88 (Kerberos), 445 (SMB) — the Active Directory port cluster

Primary use

Active Directory Global Catalog LDAP access; in practice over TCP 3268 (UDP is co-registration only)

Common software

Microsoft Active Directory domain controllers promoted as Global Catalog servers (Windows Server); GC-querying clients include Exchange Server, Outlook, and LDAP-aware forest-wide applications

Security implications

weight is on TCP 3268 — plaintext LDAP Global Catalog enables credential sniffing and directory enumeration (users/groups/OUs/forest structure) if exposed; a known AD reconnaissance technique; UDP exposure is effectively nil

Typically seen on

Windows Server domain controllers configured as Global Catalog servers (on TCP); a responsive 3268/udp is an anomaly

UDP operational status

no documented operational use; IANA co-registration only — Microsoft names TCP as the transport for GC LDAP connections [Likely] — Microsoft MS-ADTS, IANA registry

Analyst note

The documented Global Catalog stack runs over TCP; treat an open 3268/udp as unexpected and investigate rather than assume a normal service. Registration and modification dates are blank in the IANA registry and are recorded as Unknown, not invented.