What it's for
Port 389 is the default port for LDAP (Lightweight Directory Access Protocol), the protocol used to query and manage directory services — most commonly, corporate user directories like Microsoft Active Directory or OpenLDAP. Applications use LDAP on port 389 to authenticate users, look up group memberships, and retrieve organizational information (email addresses, department, phone numbers) stored in a central directory.
Protocol basics
LDAP runs over TCP, since directory queries and authentication need reliable delivery. Plain port 389 traffic can be either unencrypted or upgraded mid-connection via StartTLS, which is why port 636 (LDAPS) exists separately as the implicit-TLS alternative for anyone who wants encryption guaranteed from the start rather than negotiated. LDAP's data model is a hierarchical tree of entries (the directory information tree), each identified by a distinguished name, which clients query using LDAP's own filter syntax.