TCP Port 389 – LDAP (Lightweight Directory Access Protocol)
Port 389 is the standard port for LDAP, the Lightweight Directory Access Protocol used to query and update directory services across a network. A directory service stores structured information about an organization’s users, groups, computers, printers, and other resources, and LDAP is the standard way clients ask the directory questions like “who is this user, what groups are they in, what are their email addresses, what permissions do they have.” The protocol was specified in RFC 1487 in 1993 and has been continuously extended since.
The most common deployment by far is Microsoft Active Directory, which uses LDAP as the primary protocol for clients and applications to read and update directory data. When a Windows workstation looks up group memberships during login, when an enterprise application authenticates a user against a corporate directory, when an administrator queries the list of computers in a domain, the underlying connection typically runs through LDAP on port 389 against an Active Directory domain controller. OpenLDAP, 389 Directory Server, and other open-source LDAP implementations are also widely deployed, particularly in Unix and Linux environments.
LDAP on port 389 is the unencrypted variant. LDAPS, which wraps LDAP in a TLS encrypted session, runs on port 636 by default. Modern LDAP clients can also use the StartTLS extension to upgrade a port 389 session to TLS encryption after connecting. The older convention of plain LDAP on 389 with credentials sent in the clear has been steadily replaced by encrypted alternatives in security-conscious environments.
Inbound port 389 from the public internet is unusual in 2026 and is generally treated as a serious exposure. Outbound port 389 from end-user devices is normal within a Windows domain environment and uncommon to internet destinations.
About TCP Port 389
Port 389 carries the IANA assignment for ldap. The IANA description reads: ‘Lightweight Directory Access Protocol’.
Security Considerations
LDAP on port 389 has a complicated security profile shaped by two distinct concerns: the protocol’s plaintext-by-default authentication, and a small number of recent high-impact vulnerabilities in widely deployed LDAP server implementations.
The first concern is older and structural. Plain LDAP on port 389 transmits credentials and query contents in clear text by default. A user or service authenticating to a directory over port 389 sends their username and password unencrypted across the network, where any device on the path can read them. LDAPS on port 636 and StartTLS upgrades on port 389 both address this, but a misconfigured client or server can fall back to plaintext or accept a downgrade. Common practice in modern enterprise environments is to require encryption for all LDAP authentication and to disable simple-bind authentication over plain port 389 entirely.
The second concern is more recent and dramatic. Our data shows just 2 IDS rules referencing port 389, but both are notable. The first detects Log4Shell exploitation attempts (CVE-2021-44228), the December 2021 Apache Log4j vulnerability that allowed remote code execution against any Java application that logged attacker-controlled input. The Log4Shell technique used Java’s JNDI feature to make the vulnerable application reach out to an attacker-controlled LDAP server, which would then deliver malicious code in its response. Log4Shell was widely characterized as one of the most impactful vulnerabilities in software history, affecting an extraordinary range of enterprise applications, and the LDAP response pattern remains a useful detection signal years after disclosure.
The second rule detects exploitation of CVE-2024-49113, a vulnerability in Microsoft’s LDAP server disclosed in late 2024 that allows a denial-of-service attack through specially crafted LDAP referral responses. Public exploit code for this vulnerability appeared shortly after disclosure, and the IDS rule reflects active detection effort against ongoing exploitation attempts.
Beyond these specific vulnerabilities, LDAP servers are recurring reconnaissance targets in targeted intrusions, since a successful authenticated query against a corporate directory yields detailed information about users, groups, organizational structure, and trust relationships that an attacker can use to plan further actions.
Common practice today is unambiguous: do not expose port 389 to the public internet, require TLS encryption (either LDAPS on 636 or StartTLS on 389) for any LDAP authentication, keep directory servers patched against the latest vendor security updates, and restrict directory access at the application level to the minimum scope each application requires.
Inbound port 389 from the public internet to any host is a strong indicator of either a serious misconfiguration or an active attack and warrants immediate investigation.
IDS Rule References
1 IDS / security rule reference TCP port 389. Presence in IDS rules does not mean traffic on this port is malicious. These are patterns security tools monitor.
Rule categories (top 1): trojan-activity (1).
Sample rule descriptions for TCP port 389:
- INDICATOR-COMPROMISE JNDI LDAP searchResEntry dynamic code download attempt
Data Sources
This information is compiled from: IANA Service Name and Transport Protocol Port Number Registry, Emerging Threats Open Ruleset (BSD 2-Clause / GPLv2 per SID range), and Snort Community Rules (GPLv2).