Port 2893: VSEconnector — IBM Mainframe Connector

What This Port Is

Port 2893 is registered with IANA under the name vseconnector, assigned by IBM engineer Ingo Franzki for use with IBM's z/VSE operating system.¹

z/VSE (Virtual Storage Extended) is an IBM mainframe operating system with roots going back to 1965. It runs on IBM Z-series hardware and remains in production use today — primarily in banks, insurance companies, and large enterprises that have decades of business logic running on iron that long predates the Internet era.

VSE Connectors are IBM's framework for bridging z/VSE systems to the outside world: Java applications, web services, VSAM data, and modern TCP/IP networks. Port 2893 is one of the ports this connector framework uses for communication.²

What Range This Port Belongs To

Port 2893 falls in the registered port range (1024–49151). These ports are not reserved by IANA the way well-known ports (0–1023) are, but they are formally registered — meaning a specific vendor or organization has filed a claim. The registration does not prevent other software from using the port; it simply documents intended use.

Most registered ports belong to specific vendor products, enterprise software, and niche protocols. Port 2893 is squarely in that category: legitimately assigned, used by real systems, and invisible to the overwhelming majority of the Internet.

Who Actually Uses This Port

IBM z/VSE sites — typically large financial institutions and enterprises running mission-critical batch workloads on mainframes. If you are running z/VSE and using IBM's connector infrastructure to integrate your mainframe with distributed systems, this port may appear in your firewall rules and network diagrams.

If you are not running a mainframe, you are unlikely to encounter this port in the wild.

How to Check What's Listening

If port 2893 appears on a system you manage and you are not running z/VSE connector software, that warrants investigation.

On Linux/macOS:

# Show what process is listening on port 2893
ss -tlnp | grep 2893

# Or with lsof
lsof -i :2893

On Windows:

netstat -ano | findstr :2893

Take the process ID from the output and look it up to confirm what is actually running.

Why Unassigned-Looking Ports Matter

The port registry has over 49,000 registered slots. Most are occupied by vendor software that a small fraction of the Internet ever runs. Port 2893 is a good example of why "I don't recognize this port" is not the same as "this port is suspicious." The registry is vast, and legitimate but obscure services occupy much of it.

At the same time, unrecognized traffic on any port deserves a look. The right question is not "is this port well-known?" but "do I know what process is using it and why?"