Port 1363: Network DataMover Requester — The API door to enterprise file transfer

Port 1363 is the official IANA-registered port for ndm-requester (Network DataMover Requester), the API connection port for IBM Connect:Direct.¹ Every time an automated script triggers a file transfer, every time a scheduled job moves data between systems, the command arrives here.

What Runs on Port 1363

Connect:Direct—originally called Network Data Mover (NDM)—is a file transfer system designed to move files between mainframe computers, midrange systems, and servers.² Port 1363 is where the system listens for API connections like the "direct" command-line interface.³

When you need to move a 50GB database backup from one data center to another, or sync inventory files between warehouse management systems, or transfer financial records between mainframes—Connect:Direct handles it. Port 1363 is where those operations are initiated and controlled.

How It Works

Connect:Direct uses two ports:

• Port 1363 (ndm-requester): API connections and command-line interface
• Port 1364 (ndm-server): Inbound server connections for actual data transfer⁴

The pattern: You send commands through 1363, the actual file transfer happens through 1364. Control plane and data plane, separated.

This is different from protocols like FTP where control and data use the same connection model. Connect:Direct was designed for enterprise environments where you need guaranteed delivery, resume capability, and the ability to schedule and automate transfers without human intervention.

The History

Network Data Mover was created in the 1980s for mainframe-to-mainframe file transfers. In 1993, after Sterling Software acquired Systems Center, Inc., NDM was renamed Connect:Direct.⁵ The product passed through several owners:

• Sterling Commerce (1996 spinoff)
• SBC Communications (2000 acquisition)
• AT&T (inherited from SBC)
• IBM (2010 acquisition of Sterling Commerce)⁵

Through all those ownership changes, port 1363 remained the standard API connection port. Enterprises don't change port numbers lightly—there are too many firewall rules, too many automation scripts, too many documented procedures that reference specific ports.

What Makes This Different

Most file transfer happens over FTP (port 21), SFTP (port 22), or HTTP/HTTPS (ports 80/443). Connect:Direct exists because those protocols weren't designed for enterprise-scale automated transfers between systems that need to coordinate across different platforms—mainframes running z/OS talking to UNIX servers talking to Windows systems.

Connect:Direct provides:

• Guaranteed delivery with automatic retry and resume
• Scheduling built into the protocol
• Compression and encryption optimized for large transfers
• Cross-platform support between mainframes and distributed systems

The transfers on port 1363 are rarely initiated by humans directly. They're scheduled jobs, automated workflows, batch processes. This is the port that moves data while everyone sleeps.

Security Considerations

Port 1363 should only be accessible to systems that need to initiate Connect:Direct transfers. This is an API port—it accepts commands. If an attacker gains access to port 1363 with valid credentials, they can initiate file transfers, potentially exfiltrating data or moving malicious files between systems.

Recommendations:

• Restrict access to port 1363 using firewall rules
• Only allow connections from known system IP addresses
• Use strong authentication for Connect:Direct accounts
• Monitor port 1363 for unexpected connection attempts
• Consider using Connect:Direct Secure Plus for encrypted transfers

Checking What's Listening

To see if something is listening on port 1363:

Linux/Mac:

sudo lsof -i :1363
# or
sudo netstat -tlnp | grep 1363

Windows:

netstat -ano | findstr :1363

If you see a process listening on 1363, it's likely Connect:Direct or another NDM-compatible system waiting for API connections.

Related Ports

• Port 1364 (ndm-server): Connect:Direct server connections for data transfer⁴
• Port 21 (FTP): Traditional file transfer protocol, less automation
• Port 22 (SFTP): Secure file transfer over SSH
• Port 10000 (NDMP): Network Data Management Protocol for backup systems

The Invisible Infrastructure

You have probably never used port 1363 directly. You may never have heard of Connect:Direct. But if you have worked at a large company, received a paycheck from an enterprise HR system, or ordered something from a retailer with complex supply chain logistics—there is a non-zero chance that some of the data involved in those transactions moved through port 1363.

This is the infrastructure beneath the infrastructure. The ports that don't get press releases or explainer videos. The ports that just work, decade after decade, moving files while the world sleeps.