All Ports Required By Domain Controllers And Client Computers

Source: http://www.windowsnetworking.com/kbase/WindowsTips/WindowsServer2008/AdminTips/ActiveDirectory/WhatAllPortsAreRrequiredByDomainControllersAndClientComputers.html

This article explains the key port requirement for Client computers and Domain Controllers communicating with each other.

Active Directory communication takes place using several ports. These ports are required by both client computers and Domain Controllers. As an example, when a client computer tries to find a domain controller it always sends a DNS Query over Port 53 to find the name of the domain controller in the domain.
The following is the list of services and their ports used for Active Directory communication:

• UDP Port 88 for Kerberos authentication
• UDP and TCP Port 135 for domain controllers-to-domain controller and client to domain controller operations.
• TCP Port 139 and UDP 138 for File Replication Service between domain controllers.
• UDP Port 389 for LDAP to handle normal queries from client computers to the domain controllers.
• TCP and UDP Port 445 for File Replication Service
• TCP and UDP Port 464 for Kerberos Password Change
• TCP Port 3268 and 3269 for Global Catalog from client to domain controller.
• TCP and UDP Port 53 for DNS from client to domain controller and domain controller to domain controller.

Opening above ports in Firewall between client computers and domain controllers, or between domain controllers, will enable Active Directory to function properly.

To check the list of all active ports, open cmd in elevated mode, and use [netstat -a]  command without square brackets. It will list down all active TCP and UDP ports. Look for any port number that displays the word "LISTENING" under the "State" column and if you need to ping through a port to a specific IP use telnet.

Following link describes how to ping a specific port using "telnet [host] [port]" command after installing telnet client from "Turn Windows Features on or off".
http://www.ehow.com/how_8145972_ping-specific-port.html

The ping command sends a small burst of data to another computer, allowing you to test its Internet or network connectivity. Sometimes a user may need to test a specific network port on that computer, but since the ping command sends data on a different layer than where network ports operate, it won't be able to test specified port numbers. Thankfully, there is another method using telnet that mimics the ping command and allows you to test ports on computers on the Internet or on your remote network.

Install the telnet client. To do so, click your "Start" button, browse to "Control Panel," and then launch "Programs and Features." Click "Turn Windows features on or off" and check the "Telnet Client" box in the dialog window that appears. Click "OK."

Launch Telnet by clicking your "Start" button, browsing to "All Programs," clicking "Accessories," and then launching the "Telnet" program. You can also type "Telnet" in the search box and click the program icon as it appears.

Connect to the computer you want to test and then specify the port number that you want to test. To do so, type in "telnet [host] [port]" without the quotation marks, where [host] is the hostname or IP address of the computer to be tested and [port] is the port.

Wait for the results. If Telnet connects to the computer, then that port is active and is receiving and transmitting data.

Read more : http://www.ehow.com/how_8145972_ping-specific-port.html