Port 368 is where proxy servers introduce themselves.
Every time a WinGate client starts up, it sends out a discovery message on port 368: "Is there a WinGate server here?" And if there is, the server responds. No configuration needed. No typing in IP addresses. The protocol handles it automatically.
This is QbikGDP—the Generic Discovery Protocol that solved a very 1990s problem: how do you share one Internet connection across an entire office without making every user manually configure proxy settings?
What Runs on Port 368
QbikGDP (Qbik Generic Discovery Protocol) is the officially assigned service for port 368, operating on both TCP and UDP.1
The protocol does one thing well: it finds WinGate proxy servers on a network. WinGate Internet Client (WGIC) and GateKeeper use port 368 to broadcast discovery requests and listen for responses from WinGate servers.2
The entire exchange happens automatically. No user intervention required.
The 1995 Problem
In October 1995, Adrien de Croy released WinGate—a rewrite of an earlier product called SocketSet.3 The timing was perfect.
Mid-1990s: Most homes and small businesses had exactly one Internet connection. One modem. One phone line. One computer that could get online.
But offices had multiple computers on local networks. They needed to share that single connection. WinGate solved this by acting as a proxy server—one machine connected to the Internet, and other machines routed their traffic through it.
The problem: how do client machines find the WinGate server without manual configuration?
That's where QbikGDP came in. Clients broadcast on port 368. Servers listening on port 368 respond. Connection established. Internet shared.
By the late 1990s, WinGate was everywhere in small offices and homes that needed connection sharing.
How the Protocol Works
QbikGDP is designed to be fully automatic, requiring no user intervention.2
When a WinGate client starts:
- It sends a UDP broadcast on port 368: "Any WinGate servers here?"
- WinGate servers listening on port 368 respond with their address and capabilities
- The client connects to the discovered server
- Internet access flows through the proxy
The protocol supports both IPv4 and IPv6, and Cisco network equipment categorizes it under "network-management" in their NBAR (Network-Based Application Recognition) system.2
What Changed
In 1998, Microsoft released Windows 98 with Internet Connection Sharing (ICS) built in. Around the same time, cheap NAT-enabled routers became available.3
Suddenly, you didn't need proxy server software to share an Internet connection. The operating system or a $50 router could do it.
WinGate had to evolve. Today, it focuses on enterprise features: access control, email serving, caching, bandwidth management, content filtering.3 Less about sharing a connection, more about controlling and monitoring network traffic.
But QbikGDP remains. Port 368 still listens. The discovery protocol still works.
Security Considerations
Early versions of WinGate (before 2.1d in 1997) shipped with insecure default configurations.3 If administrators didn't lock them down, third parties could route traffic through these servers—essentially free proxy access for anyone who found them.
Port 368 has also been flagged historically for trojan and virus activity.4 Any automatic discovery protocol can be exploited: malware can listen on port 368 and pretend to be a WinGate server, intercepting traffic.
Modern security practices:
- Firewall port 368 if you're not running WinGate
- Monitor for unexpected services listening on this port
- If running WinGate, ensure proper authentication and access controls
Who Still Uses This
WinGate is actively maintained by Qbik New Zealand Limited in Auckland. The latest version (9.4.7) was updated in December 2025.3
Organizations running WinGate today typically use it for:
- Detailed web proxy and content filtering
- Email gateway services
- Bandwidth management
- Network access logging and reporting
The discovery protocol remains useful in enterprise environments where WinGate servers are deployed across multiple locations and automatic configuration simplifies management.
Checking Port 368
To see if anything is listening on port 368 on your machine:
Linux/Mac:
Windows:
If you see something listening and you're not running WinGate, investigate. This port should be quiet on most systems.
Related Ports
- Port 8080 - Common HTTP proxy port where many proxy servers listen
- Port 3128 - Squid proxy default port
- Port 1080 - SOCKS proxy protocol
The Quiet Persistence
Port 368 represents a specific moment in Internet history: when connection sharing required specialized software and automatic discovery protocols.
That moment passed. Built-in operating system features and cheap routers made dedicated proxy software unnecessary for basic connection sharing.
But the protocol persists. WinGate evolved. Port 368 still carries discovery requests. Networks still use it.
The automatic handshake continues—quieter now, but still asking: "Are you there?"
Was this page helpful?