88
Summary
- // if you see it open
- AD-centric and high-value: Kerberoasting (request SPN service tickets, crack offline; MITRE T1558.003; Rubeus, Impacket GetUserSPNs, Mimikatz); AS-REP roasting (pre-auth disabled; T1558.004); Golden/Silver Ticket forgery via krbtgt/service-account hash and pass-the-ticket (T1558).
- // common applications
- Microsoft Active DirectoryMIT KerberosHeimdal
- // analyst note
- An open 88 strongly indicates a KDC / Windows Domain Controller. Anchor an AD attack-surface review here (Kerberoasting/AS-REP exposure, pre-auth posture) and correlate with 389/636 to confirm a DC.
About port 88/tcp.
Port 88/tcp carries the Kerberos network authentication protocol, on which the Key Distribution Center (KDC) listens — and in Microsoft Active Directory, an open port 88 is one of the clearest signals that a host is a Domain Controller. Kerberos provides ticket-based mutual authentication over untrusted networks using symmetric-key cryptography and a trusted third party, with a heritage in the Needham–Schroeder protocol; it was developed at MIT's Project Athena and named for Cerberus/Kerberos, the three-headed dog of Greek mythology. Authentication proceeds in two phases: AS-REQ/AS-REP with the Authentication Service to obtain a Ticket-Granting Ticket (TGT), then TGS-REQ/TGS-REP with the Ticket-Granting Service to obtain service tickets. Both UDP and TCP 88 are used — UDP was historically the default (RFC 1510), while TCP is required for large tickets (such as PAC-heavy Active Directory tickets) or when UDP fails, and modern Windows tries TCP readily; RFC 4120 (Kerberos V5, which obsoletes RFC 1510) requires KDCs to accept TCP on 88, and Microsoft's [MS-KILE] states both UDP and TCP port 88 are used for client–KDC communication. The IANA registry cites RFC 4120 as the reference for kerberos/88 (assignee B. Clifford Neuman, modified 2022-02-18) — one of the few entries in this cluster with a populated reference field. Security exposure on 88 is heavily Active Directory-centric and high-value: Kerberoasting requests service tickets for accounts with Service Principal Names and cracks the service-account password offline (MITRE ATT&CK T1558.003, a technique popularized around 2014 by Tim Medin; tools include Rubeus, Impacket's GetUserSPNs, and Mimikatz); AS-REP roasting targets accounts with Kerberos pre-authentication disabled (T1558.004); and Golden Ticket / Silver Ticket forgery abuses the krbtgt or service-account hash to mint tickets (under T1558, Steal or Forge Kerberos Tickets), enabling pass-the-ticket lateral movement. For an analyst, an open 88 strongly indicates a KDC / Windows Domain Controller and should anchor an Active Directory attack-surface review.
- IANA assignment
kerberos— "Kerberos"; reference [RFC4120]; assignee/contact B. Clifford Neuman; modified 2022-02-18 [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023)
- Prevalence
- common on enterprise/AD networks (de-facto, nmap-services; aliases kerberos5/krb5/kerberos-sec) [Well-established] — nmap-services file
- Related ports
- 88/udp (Kerberos); 464 (kpasswd); 749/750 (kerberos-adm / kerberos-iv); the AD cluster (53, 135, 139, 389, 445, 464, 636, 3268, 3269)
Primary use
Kerberos KDC authentication (AS-REQ/AS-REP, TGS-REQ/TGS-REP); central to Active Directory logon
Other/unofficial uses
Kerberos for non-AD realms (MIT/Heimdal KDCs), Kerberized services [Well-established]
Security implications
Kerberoasting (T1558.003; Rubeus, Impacket GetUserSPNs, Mimikatz); AS-REP roasting (T1558.004); Golden/Silver Ticket forgery and pass-the-ticket (T1558); TCP 88 used for large/PAC-heavy tickets
Typically seen on
Windows Domain Controllers, MIT/Heimdal KDCs
- Analyst note
- An open 88 strongly indicates a KDC / Windows Domain Controller. Anchor an AD attack-surface review here (Kerberoasting/AS-REP exposure, pre-auth posture) and correlate with 389/636 to confirm a DC.
About port 88/udp.
Port 88/udp is the historically primary transport for the Kerberos network authentication protocol, on which the Key Distribution Center (KDC) listens — and as with TCP 88, an open UDP 88 is a strong indicator that a host is a Kerberos KDC, most often a Microsoft Active Directory Domain Controller. The protocol is identical regardless of transport: clients exchange AS-REQ/AS-REP with the Authentication Service to obtain a Ticket-Granting Ticket (TGT), then TGS-REQ/TGS-REP with the Ticket-Granting Service to obtain service tickets, all built on symmetric-key cryptography and a trusted third party (the Needham–Schroeder heritage, developed at MIT Project Athena and named for the three-headed dog Kerberos). UDP was the original default transport in RFC 1510, and it remains widely used for ordinary Kerberos exchanges; the protocol falls back to TCP 88 when responses are too large (for example PAC-heavy Active Directory tickets) or when UDP is unreliable, and RFC 4120 requires KDCs to also accept TCP. The IANA registry cites RFC 4120 as the reference for kerberos/88 on both transports (assignee B. Clifford Neuman, modified 2022-02-18). Security exposure mirrors TCP 88 and is Active Directory-centric: Kerberoasting (MITRE ATT&CK T1558.003), AS-REP roasting (T1558.004), and Golden/Silver Ticket forgery with pass-the-ticket lateral movement (T1558), using tools such as Rubeus, Impacket (GetUserSPNs, GetNPUsers), and Mimikatz. For an analyst, an open 88/udp anchors the same Active Directory attack-surface review as the TCP port; correlate with 389 and 636 to confirm a Domain Controller, and note that some environments and clients prefer TCP 88, so UDP and TCP should be assessed together.
- IANA assignment
kerberos— "Kerberos"; reference [RFC4120]; assignee/contact B. Clifford Neuman; modified 2022-02-18 [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023)
- Prevalence
- common on enterprise/AD networks (de-facto, nmap-services; aliases kerberos5/krb5/kerberos-sec) [Well-established] — nmap-services file
- Related ports
- 88/tcp (Kerberos); 464 (kpasswd); 749/750 (kerberos-adm / kerberos-iv); the AD cluster (53, 135, 139, 389, 445, 464, 636, 3268, 3269)
Primary use
Kerberos KDC authentication over UDP (historically the default transport)
Other/unofficial uses
Kerberos for non-AD realms (MIT/Heimdal KDCs) [Well-established]
Security implications
same AD-centric attacks as TCP 88 — Kerberoasting (T1558.003), AS-REP roasting (T1558.004), Golden/Silver Ticket forgery and pass-the-ticket (T1558); large/PAC-heavy responses cause fallback to TCP 88
Typically seen on
Windows Domain Controllers, MIT/Heimdal KDCs
- Analyst note
- Open 88/udp anchors the same AD attack-surface review as TCP 88. Correlate with 389/636 to confirm a Domain Controller, and assess UDP and TCP 88 together since clients may prefer TCP.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| kerberos-sec | UDP | Kerberos (v5) | 1.35% |
| kerberos-sec | TCP | kerberos | 0.61% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.