Port 396: Novell NetWare/IP — The Tunnel That Led Nowhere

What Port 396 Does

Port 396 was officially assigned by IANA for NetWare/IP—a protocol Novell created in the mid-1990s that wrapped IPX (Internetwork Packet Exchange) packets inside IP packets.¹² It runs on both TCP and UDP.

If you've never heard of NetWare or IPX, that tells you everything you need to know about how this story ends.

The Protocol Wars

In the early 1990s, Novell NetWare dominated corporate networks. Their IPX/SPX protocol stack ran on millions of machines. But TCP/IP—the protocol suite designed for the Internet—was spreading fast.³

Companies needed to connect their NetWare networks to the Internet. The right answer was to migrate everything to TCP/IP. The answer Novell chose was NetWare/IP: tunnel the old protocol through the new one and pretend the problem didn't exist.

How NetWare/IP Worked

NetWare/IP took IPX packets and wrapped them in IP packets—a technique called tunneling.⁴ Servers and clients could communicate over pure TCP/IP networks without abandoning IPX entirely.

Port 396 handled communication between NetWare/IP clients and Domain Serving Services (DSS) servers—the infrastructure that managed addressing and routing in NetWare/IP environments.⁵

In theory, this let companies keep their NetWare infrastructure while adopting TCP/IP. In practice, it was slow, complicated, and everyone knew it was temporary.

Why It Failed

The tunneling overhead killed performance. The implementation was complex. And fundamentally, NetWare/IP was a delaying tactic—a way to avoid the inevitable migration to native TCP/IP.⁶

By 1998, Novell released NetWare 5.0 with full native TCP/IP support.⁷ NetWare/IP became obsolete almost immediately. Port 396 stopped carrying meaningful traffic.

The Genuine Strangeness

Port 396 is a monument to corporate denial. Novell saw TCP/IP coming, understood what it meant for their proprietary protocol stack, and chose to build a bridge instead of crossing the river.

The Internet didn't care. TCP/IP won. IPX is dead. NetWare is dead. And port 396 sits in the IANA registry as a reminder that you can't tunnel your way out of technological obsolescence.

Today

You will almost never see traffic on port 396. NetWare/IP deployments have been extinct for decades. If you see this port open on a modern system, it's either:

• An ancient server that somehow still exists
• A misconfiguration
• Malware using an abandoned port number

Check what's listening:

# Linux/Mac
sudo lsof -i :396
sudo netstat -tulpn | grep :396

# Windows
netstat -ano | findstr :396

Why This Port Matters

Port 396 is a lesson in technological transition. When a dominant standard faces replacement, companies try to hedge—build compatibility layers, maintain backward compatibility, tunnel the old through the new.

Sometimes that works. Often it just delays the inevitable.

The Internet's port registry is full of these fossils—ports assigned to protocols that lost, technologies that died, companies that bet wrong. Port 396 is one of them.

Every abandoned port is a gravestone. This one marks Novell's attempt to survive the protocol wars by pretending they could have it both ways.

They couldn't.

Related Ports

• Port 213 - IPX (Internetwork Packet Exchange) - The original Novell protocol
• Port 524 - NCP (NetWare Core Protocol) - NetWare's native file and print protocol
• Port 2010 - NetWare/IP secondary service port