Kerberos Packet Filtering
88/udp
Clients <-> KDCs
Regular authentication traffic
749/tcp
Clients -> master KDC
Password changes, add/change/delete principals
754/tcp
Master KDC -> Slave KDCs
Database replication