389
Summary
- // if you see it open
- Simple bind without TLS sends credentials in cleartext (capture/sniffing). Anonymous/null bind can disclose directory contents. LDAP injection where filter input is unsanitized. AD reconnaissance goldmine (BloodHound, ldapsearch, Nmap ldap-search/ldap-rootdse). Connectionless LDAP over UDP 389 (CLDAP) is a major DDoS reflection/amplification vector (~56-70x; Akamai, Jan 2017). Microsoft LDAP channel-binding/signing hardening (ADV190023, 2020-2021) mitigates relay/MITM.
- // common applications
- Microsoft Active DirectoryOpenLDAP389 Directory ServerFreeIPA
- // analyst note
- Open 389 (especially with 88 and 636) strongly suggests an Active Directory Domain Controller. Test for anonymous bind and StartTLS; treat cleartext LDAP exposed to untrusted networks as an info-disclosure and DDoS-reflection risk.
About port 389/tcp.
Port 389/tcp carries the Lightweight Directory Access Protocol, the client/server protocol for querying and modifying a hierarchical directory — and the backbone of enterprise directory services including Microsoft Active Directory and OpenLDAP. LDAP organizes entries into a Directory Information Tree, addresses them by Distinguished Names (DN) built from Relative Distinguished Names (RDN), and exposes typed attributes; the core operations are bind (authenticate), search, compare, and add/modify/delete. Its lineage runs from X.500 through LDAPv1 (RFC 1487), LDAPv2 (RFC 1777), and LDAPv3 (RFC 2251), to the current LDAPv3 revision in RFC 4510 (roadmap), RFC 4511 (protocol), RFC 4513 (authentication and StartTLS), and RFC 4516 (LDAP URL). Traffic on 389 is cleartext by default but can be upgraded in-band to TLS via StartTLS (originally RFC 2830, now RFC 4513). The IANA registry lists ldap with a blank reference field (assignee Tim Howes), so the LDAPv3 RFCs are the governing specifications but not the IANA-cited reference. Security exposure on 389 is significant: a simple bind without TLS sends credentials in cleartext (sniffable and subject to capture); anonymous or null binds can disclose directory contents; LDAP injection (the directory analogue of SQL injection) is possible where filter input is unsanitized; and in Active Directory environments LDAP is a reconnaissance goldmine, with tools such as ldapsearch, Nmap's ldap-search/ldap-rootdse scripts, and BloodHound enumerating users, groups, and computers. Connectionless LDAP over UDP 389 (CLDAP) is additionally a major DDoS reflection/amplification vector — Akamai publicly documented CLDAP reflection in January 2017, reporting amplification factors in the roughly 56–70× range. Microsoft's 2020–2021 LDAP channel binding and signing hardening (advisory ADV190023) was issued to mitigate relay/MITM. For an analyst, an open 389 (often alongside 88 and 636) is a strong Active Directory Domain Controller signal; test for anonymous bind and StartTLS support, and treat cleartext LDAP exposed to untrusted networks as both an info-disclosure and a DDoS-reflection risk.
- IANA assignment
ldap— "Lightweight Directory Access Protocol"; reference (blank — no RFC cited in IANA registry); assignee/contact Tim Howes; governing protocol RFC 4511 (LDAPv3, not the IANA-cited reference) [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023)
- Prevalence
- common on enterprise/AD networks (de-facto, nmap-services) [Well-established] — nmap-services file
- Related ports
- 636 (LDAPS, implicit TLS); 3268/3269 (AD Global Catalog LDAP/LDAPS); 88 (Kerberos) and 445 (SMB) in the AD cluster
Primary use
directory access (bind/search/compare/modify) for AD and OpenLDAP; cleartext by default with optional StartTLS
Other/unofficial uses
directory-backed authentication and address-book lookups [Well-established]
Security implications
cleartext credentials on simple bind without TLS; anonymous/null-bind disclosure; LDAP injection; AD reconnaissance (BloodHound, ldapsearch); CLDAP (UDP 389) reflection/amplification DDoS (~56–70×, Akamai Jan 2017); Microsoft channel-binding/signing hardening (ADV190023, 2020–2021)
Typically seen on
Active Directory Domain Controllers, OpenLDAP / 389 Directory Server
- Analyst note
- Open 389 (especially with 88 and 636) strongly suggests an Active Directory Domain Controller. Test for anonymous bind and StartTLS; treat cleartext LDAP exposed to untrusted networks as an info-disclosure and DDoS-reflection risk.
About port 389/udp.
Port 389/udp is registered with IANA as ldap ("Lightweight Directory Access Protocol"), assignee Tim Howes, with a blank reference field — it is dual-registered alongside 389/tcp, which carries the same service name, description, and assignee. While LDAP proper is a TCP protocol, the UDP variant on port 389 is CLDAP, the Connection-less Lightweight Directory Access Protocol defined in RFC 1798 (June 1995, now Historic and obsoleted by RFC 3352). In practice the dominant real-world use of UDP 389 is Microsoft Active Directory's DC Locator mechanism: Windows clients send connectionless "LDAP ping" requests (DsGetDcName / NetLogon) over UDP 389 to discover domain controllers and retrieve Active Directory site information without a TCP handshake. For an analyst, the security story is what matters most. Because CLDAP is stateless and unauthenticated, internet-exposed CLDAP servers are a well-documented DDoS reflection/amplification vector: an attacker spoofs a victim's source IP, sends small queries, and the server returns much larger responses to the victim. Empirical amplification factors range from roughly 42x (F5 Labs controlled tests) up to a "70x" figure reported by some sources, placing CLDAP in the same tier as DNS amplification. The vector was publicly reported by Corero in October 2016, and Akamai recorded a 24 Gbps / 2 Mpps CLDAP-only attack on 7 January 2017. A responsive UDP 389 facing the internet is therefore something to investigate: it is rarely a legitimate need outside a controlled AD environment, and exposed CLDAP is both a reflection liability and a plaintext-directory risk. Recommended mitigations are to block UDP 389 at the perimeter for hosts that do not need to serve external DC Locator clients, migrate authentication to LDAPS (TCP 636), and disable CLDAP where unused.
- IANA assignment
ldap— "Lightweight Directory Access Protocol"; reference (blank — no RFC cited in the registry row); assignee Tim Howes; dual-registered 389/tcp + 389/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry, 389/udp row)- Range class
- well-known (0–1023) [Confirmed]
- IANA reference field
- blank (registry row carries no RFC); the relevant CLDAP spec is RFC 1798 (Historic), but it is not cited in the IANA row [Confirmed] — IANA registry; RFC 1798 (IETF datatracker)
- Related ports
- 389/tcp (LDAP); 636/tcp (LDAPS); 3268/3269 (AD Global Catalog) [Likely]
Primary use
CLDAP — Connection-less LDAP (RFC 1798, Historic, obsoleted by RFC 3352); in practice Microsoft Active Directory DC Locator "LDAP ping" (DsGetDcName / NetLogon) for domain-controller discovery
Common software
Microsoft Active Directory domain controllers (Windows Server) answer CLDAP LDAP-ping requests on UDP 389; non-Microsoft directory servers (OpenLDAP, 389 Directory Server) use TCP 389, with UDP exposure incidental
Security implications
well-known DDoS reflection/amplification vector. Stateless, unauthenticated CLDAP allows spoofed-source reflection with amplification ~42x (F5 Labs measured) up to ~70x (reported); vector publicly reported October 2016 (Corero); Akamai recorded a 24 Gbps / 2 Mpps CLDAP-only attack on 7 Jan 2017; ranked ~6th among amplification protocols by F5 Labs. SANS ISC records ongoing 389 scanning; UK NCSC/gov guidance lists open 389 as a medium-severity finding
Exposure population (point-in-time)
Shodan ~1,984 publicly reachable UDP-389 LDAP servers at F5 Labs' analysis; Akamai identified 7,629 unique reflectors in attacks through early 2017 (different populations/dates)
- Plaintext risk
- LDAP/CLDAP on 389 transmits queries (and, on TCP, credentials) in cleartext; the UDP path is additionally exploitable for unauthenticated reflection [Confirmed] — openportcheckers, UpGuard
- Analyst note
- An internet-facing UDP 389 is rarely a legitimate need outside a controlled AD deployment — treat exposed CLDAP as both a reflection-DDoS liability and a plaintext-directory exposure; mitigate by perimeter-blocking UDP 389, moving auth to LDAPS, and disabling unused CLDAP.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| ldap | TCP | Lightweight Directory Access Protocol | 0.47% |
| ldap | UDP | Lightweight Directory Access Protocol | 0.43% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.