388
Summary
- // typical exposure
- Restricted (trusted networks only) — LDM is designed for peer-to-peer data exchange among hosts explicitly listed in each instance's access-control configuration, so it is a legitimate service that should be limited to trusted/allowlisted peers rather than exposed to the open internet.
- // common applications
- Unidata LDM Traffic on this port is most often Unidata LDM peer connections distributing meteorological/scientific data feeds (e.g. NOAAPort) between access-control-listed academic and research hosts; unrelated traffic has been anecdotally flagged as suspicious by low-authority port-database sites but without a named application.
- // analyst note
- an open port 388 outside an academic/meteorological-research context is unusual and worth checking against an LDM deployment before assuming malicious use.
- // if you see it open
- Legitimate LDM traffic is gated by a per-host access-control list rather than open public listening, so port 388 should stay restricted to known peer hosts. Generic 'Trojan'/malware associations appear on low-authority port-database sites (auditmypc.com, portsmaster.net) but name no specific malware family, sample, or dated incident, and GRC's port-388 lookup shows only the legitimate unidata-ldm registration -- treat any malware attribution as unverified. The port was not found in the mainstream scan-volume trackers checked.
About port 388/tcp.
Port 388/tcp (and udp) carries Unidata LDM (Local Data Manager), a real-time meteorological and scientific data-distribution protocol; it should stay restricted to trusted peer hosts via LDM's access-control list rather than be exposed openly to the public internet.
IANA registers 388 to unidata-ldm — "Unidata LDM" — assigned to the University Corporation for Atmospheric Research (UCAR), contact Steven Emmerson, with a blank Reference field and no cited RFC. The assignment is dual-registered on TCP and UDP with identical metadata; the registry's Registration Date column is blank, and the Modification Date is 2012-05-18.
LDM is developed by the Unidata Program at UCAR to move real-time data — notably NOAAPort and other weather feeds — between cooperating hosts, mostly at universities, NWS/NOAA-affiliated sites, and research institutions. Each LDM instance opens outbound and inbound TCP connections on port 388 only to hosts explicitly listed in that instance's access-control configuration, which is the mechanism that keeps the service from needing to face the open internet.
Generic port-database sites list unspecified "Trojan" associations for port 388, but none names a malware family, sample, or dated incident, and GRC's own port-388 lookup shows only the legitimate LDM registration — so that claim is treated as unverified rather than asserted. The port also did not appear in the mainstream scan-volume trackers checked.
- IANA assignment
unidata-ldm— "Unidata LDM"; reference (blank — no RFC cited); assignee University Corporation for Atmospheric Research (UCAR), contact Steven Emmerson; dual-registered 388/tcp + 388/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry- Registration date
- blank (not recorded); Modification date: 2012-05-18 [Confirmed] — IANA registry (the IANA Service Name and Transport Protocol Port Number Registry)
- Range class
- well-known (0–1023) [Confirmed]
- Prevalence
- nmap-services open-frequency for 388/tcp ≈0.000088 [Confirmed] — nmap-services dataset (this site's own tooling)
- Related ports
- none specifically documented as related [Unknown]
Primary use
Unidata LDM (Local Data Manager) — real-time distribution of meteorological/scientific data (e.g. NOAAPort feeds) between hosts on an access-control list
Other/unofficial uses
none credibly documented beyond LDM itself [Confirmed — absence noted]
Security implications
legitimate use is gated by LDM's per-host access-control list rather than open listening; generic "Trojan" claims on low-authority port-database sites name no specific malware family or incident and are unverified; not observed in mainstream scan-volume trackers checked
Typically seen on
academic, NWS/NOAA-affiliated, and research-institution hosts running Unidata LDM
- Analyst note
- an open port 388 outside an academic/meteorological-research context is unusual and worth checking against an LDM deployment before assuming malicious use.
About port 388/udp.
Port 388/udp is registered with IANA as unidata-ldm, tied to Unidata's Local Data Manager (LDM) software; it should stay restricted to explicitly allow-listed institutional peers rather than being exposed broadly on the public internet.
IANA lists the assignment for both TCP and UDP transports, assignee University Corporation for Atmospheric Research (UCAR), contact Steven Emmerson, with a blank Reference field — no RFC is cited, and none should be inferred. The registry's Registration Date column is blank; the Modification Date is 2012-05-18.
LDM is the client/server transport at the core of Unidata's Internet Data Distribution (IDD) system, which event-driven-pushes near-real-time earth-science data — GOES satellite imagery, weather radar, and numerical-weather-prediction output from NCEP, the Canadian Meteorological Centre, and the US Navy's FNMOC — to university and research LDM nodes. It is a niche academic/research meteorology tool, not general-purpose software.
Notably, Unidata's own network-security documentation for the ldmd daemon describes only a TCP connection requirement for LDM peers and does not document any UDP usage; the IANA UDP registration for port 388 may reflect a paired-with-TCP convention rather than real UDP traffic, so UDP-specific sightings on this port should be treated as unconfirmed against vendor documentation.
- IANA assignment
unidata-ldm— "Unidata LDM"; reference (blank — no RFC cited); assignee University Corporation for Atmospheric Research (contact Steven Emmerson); registration date blank, modified 2012-05-18; dual-registered 388/tcp + 388/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry)- Range class
- well-known (0–1023) [Confirmed]
- Prevalence
- nmap-services open-frequency for 388/udp ≈0.000329 [Confirmed] — nmap-services dataset (this site's own tooling)
- Related ports
- none identified [Unknown — no related-port relationship documented]
Primary use
Unidata Local Data Manager (LDM), the transport at the core of the Unidata Internet Data Distribution (IDD) system, pushing near-real-time meteorological/earth-science data to university and research nodes
Other/unofficial uses
none credibly sourced; aggregator sites (SpeedGuide, PortsMaster, auditmypc) offer unsourced, contradictory alternate guesses (IBM ADE configuration, iSNS) not adopted here [Unknown]
Security implications
LDM peer access is gated by an ldmd.conf allow-list plus reverse-DNS verification; ldmd does not use TCP-Wrappers; root privilege is held only transiently to bind the port; no CVE or exploit history found
Typically seen on
Unidata IDD member institutions (universities, NWS-affiliated research sites) running ldmd
- TCP/UDP discrepancy
- Unidata's own ldmd network-security documentation describes only a TCP connection requirement for LDM peers; no UDP usage is documented, so 388/udp traffic specifically is unconfirmed against vendor documentation [Likely] — https://docs.unidata.ucar.edu/ldm/current/networkSecurityAndSetup.html
- Analyst note
- a responsive 388/udp outside a known Unidata/IDD research-network context is unexpected — treat as anomalous or misconfigured LDM peering rather than assume broad legitimate use.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| unidata-ldm | UDP | Unidata LDM Version 4 | 0.03% |
| unidata-ldm | TCP | Unidata LDM Version 4 | 0.01% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.