HTTPfy

Port 3268 (AD Global Catalog)

LDAP queries against the Active Directory Global Catalog (forest-wide searches).

Registered (user) port, 1024-49151 TCP Directory and authentication Do not expose to the internet

What port 3268 is used for

LDAP queries against the Active Directory Global Catalog (forest-wide searches).

Security: should port 3268 be open?

Do not expose to the internet. Internal only, same concerns as LDAP 389.

IANA assignment

Service nameProtoDescriptionAssigneeReference
msft-gc TCP Microsoft Global Catalog - -
msft-gc UDP Microsoft Global Catalog - -

Check what is listening on port 3268

Linux: is anything listening on TCP 3268?
sudo ss -tlnp 'sport = :3268'
Linux / macOS: which process owns the port
sudo lsof -nP -i :3268
Older Linux / BSD (net-tools)
sudo netstat -tlnp | grep ':3268 '
Windows (Command Prompt)
netstat -ano | findstr :3268
Windows (PowerShell)
Get-NetTCPConnection -LocalPort 3268 -State Listen | Select LocalAddress,OwningProcess

Test it from outside

From another machine
nc -vz -w 5 HOST 3268
From Windows
Test-NetConnection HOST -Port 3268

Block port 3268 in the firewall

ufw
sudo ufw deny 3268/tcp
iptables
sudo iptables -A INPUT -p tcp --dport 3268 -j DROP
nftables
sudo nft add rule inet filter input tcp dport 3268 drop
Windows Firewall
New-NetFirewallRule -DisplayName 'Block TCP 3268' -Direction Inbound -Protocol TCP -LocalPort 3268 -Action Block

Related ports

3269AD Global Catalog over TLS389LDAP636LDAPS3266ns-cfg-server3267ibm-dial-out3270verismart

All port numbers · Open port checker
Assignment data: IANA port number registry (public domain), retrieved 2026-11-10.