Port 88: Kerberos
Port 88 is Kerberos, the ticket-based login system Windows domains use.
What runs on port 88
Kerberos key distribution centres listen on TCP and UDP 88 and issue tickets that let users prove who they are to other services without sending their password each time. Every Active Directory domain controller runs it. MIT Kerberos and Heimdal are common Unix implementations.
On a home network
Home networks rarely have a Kerberos server. Xbox consoles use UDP 88 for Xbox network connectivity, which is why console setup guides list it; that is the console connecting out, not a service you need to expose.
If port 88 is reachable from the internet
A domain controller with 88 reachable from the internet lets attackers check which usernames exist and attempt attacks such as password spraying and requesting tickets they can try to crack offline. It should only be available inside the network or over a VPN.
How to check whether it is open on your network
If an outside scan of your public address shows 88, look for a port forward to a server. For Xbox connectivity, the console's network settings report your NAT type, which is the thing to check first.
To find out whether port 88 is open on something in your home, and whether the internet can reach it, the app scans your Wi-Fi from your phone and checks your public address from the outside. It says what it checked and what it could not. Get RECON for iPhone — one-time purchase, no account, nothing leaves the device.