Common attacks and weaknesses
- Forest-wide enumeration of users and groups.
Port 3268: Global Catalog (LDAP)
Active Directory Global Catalog queries (3269 over TLS).
3268
How Global Catalog (LDAP) works
Directory & authenticationThe client proves who it is on port 3268 and gets an answer (or a ticket) it can use with other services. Encryption is optional: traffic is only protected if TLS is enabled on the server and the client.
- Transport
- TCP · UDP
- Exposure risk
- 6/10 high if reachable from the Internet
- Encryption
- Optional TLSTLS only if negotiated
- IANA status
- Assigned1 registered service
- Range
- Registered (1024-49151)
- Category
- Directory & authentication
Is port 3268 dangerous?
How to secure it
- Restrict to internal networks; require signing.
IANA registry entries for port 3268
| Service | Port | Transport | Description | Reference | Updated |
|---|---|---|---|---|---|
| msft-gc | 3268 | TCP, UDP | Microsoft Global Catalog | - | - |
// source: IANA service name and port number registry
Which program uses port 3268, and is it reachable?
Linux
sudo ss -ltnup 'sport = :3268' # process listening on 3268
sudo lsof -nP -i :3268macOS
sudo lsof -nP -i :3268
Windows (PowerShell)
Get-NetTCPConnection -LocalPort 3268 -State Listen | Select LocalAddress, OwningProcess Get-NetUDPEndpoint -LocalPort 3268 netstat -ano | findstr :3268
From another machine
nmap -p 3268 -sV <host> sudo nmap -sU -p 3268 <host> nc -zv <host> 3268
Block it in the firewall
sudo ufw deny 3268/tcp # Linux (ufw) New-NetFirewallRule -DisplayName "Block 3268" -Direction Inbound -LocalPort 3268 -Protocol TCP -Action Block # Windows
What is port 3268 used for?
Active Directory Global Catalog queries (3269 over TLS).
Is port 3268 TCP or UDP?
Port 3268 is registered for TCP and UDP. In practice the service mostly uses TCP.
Is it safe to open port 3268?
It is rated 6/10 (high) when exposed to the Internet. Forest-wide enumeration of users and groups. Restrict to internal networks; require signing.
How do I check if port 3268 is open?
On Linux run "ss -ltnup 'sport = :3268'", on macOS "lsof -nP -i :3268", and on Windows "netstat -ano | findstr :3268" to see the local process. From another machine, "nmap -p 3268 <host>" shows whether it is reachable.