Port 860: iSCSI (system port) — The privileged port that's almost never used

Port 860 is the iSCSI system port—officially assigned by IANA for Internet Small Computer Systems Interface traffic, but almost never used in practice.

What iSCSI Does

iSCSI (Internet Small Computer Systems Interface) lets storage devices communicate over regular IP networks. Instead of requiring specialized Fibre Channel cables and infrastructure, iSCSI encapsulates SCSI commands inside TCP packets. A server can connect to a storage array across a network as if it were directly attached.

This matters because it means you can build storage area networks (SANs) using standard Ethernet instead of expensive specialized hardware.

Why Port 860 Exists (But Isn't Used)

When iSCSI was standardized in RFC 3720, the protocol needed port assignments. IANA assigned two:¹²

• Port 3260 — The standard iSCSI port (user port range, 1024-49151)
• Port 860 — The iSCSI system port (system port range, 0-1023)

Port 860 was reserved for implementations that specifically need a privileged system port. On Unix-like systems, ports below 1024 require root privileges to bind. If an iSCSI implementation needed that level of access control, port 860 was available.

But here's the thing: implementations must not default to port 860. RFC 3720 is explicit—3260 is the only allowed default.³ If you want to use 860, you have to configure it deliberately.

In practice, almost nobody does. Port 3260 handles the vast majority of iSCSI traffic in the world. Port 860 sits assigned but dormant.

How to Check What's Using Port 860

If you suspect something is listening on port 860:

# Linux/macOS - see what's listening
sudo lsof -i :860

# Linux - alternative using ss
sudo ss -tulpn | grep :860

# Windows - check listening ports
netstat -ano | findstr :860

If you see iSCSI traffic on port 860, someone explicitly configured it that way. It didn't happen by default.

Security Considerations

Port 860 falls within the well-known/system ports range (0-1023), which means:

• On Unix-like systems, binding to this port requires root/superuser privileges
• Firewalls often treat system ports differently than higher-numbered ports
• Any service claiming to listen on 860 should be verified—it requires elevated permissions

If you're running iSCSI, it's almost certainly on port 3260, not 860. If something is listening on 860 and you didn't explicitly configure it, investigate.

Related Ports

• Port 3260 — The actual iSCSI port that everyone uses
• Port 860 — This port (the system alternative)

Why Unassigned Ports Matter

Port 860 isn't unassigned—it has a designated purpose. But its story illustrates something important about how port assignments work: having an official assignment doesn't mean the port sees heavy use.

IANA maintains the registry to prevent conflicts. Port 860 is reserved so that implementations needing a privileged iSCSI port can use it without colliding with other services. The fact that it's rarely used doesn't diminish its value as a reserved resource.

The Internet runs on agreements like this. Ports are claimed, registered, and held—even if they spend most of their time idle.