Port 10397: Unassigned—But Claimed by WSO2 for Thrift

The Range: Registered but Empty

Port 10397 sits in the registered user port range (1024-49151). This range exists because you can't call a port well-known if everyone running a server would claim the same ones. The registered range lets applications apply to IANA for an official assignment—and when they don't, the port remains unassigned but available.

Port 10397 has no official IANA assignment. It never went through the Expert Review process. It was never formally registered. And yet it is reliably, actively in use.

The Unofficial Use: WSO2 Thrift

WSO2 API Manager uses port 10397 as its default Thrift port—the channel where distributed nodes in a WSO2 cluster communicate with each other.¹

Thrift is Facebook's serialization framework for cross-language service calls. In WSO2, it handles internal server-to-server communication: the Gateway node talks to the Key Manager node, the API Publisher talks to the Analytics node. These conversations happen on 10397 by default, though the port can be offset in configuration.

This is not a protocol running on the public Internet. It's not exposed to browsers or external clients. It's the nervous system of a private cluster—the conversations the servers have with each other when the doors are closed.

Why This Matters

Port 10397 illustrates something fundamental about the Internet's port system: official doesn't always mean what's actually there.

IANA maintains the registry of assigned ports. The process exists. But thousands of applications running on millions of servers make practical decisions about which ports to use. Some register formally. Others—like WSO2—choose an available port, configure it in their documentation, and move forward. The collision risk is low enough that it works.

The Internet is resilient partly because it's forgiving about this gap. Port 10397 could be officially assigned tomorrow. WSO2 could change their default. But for now, it exists in a quiet agreement: "No one's using this number, so we will."

Checking What's on Port 10397

If you suspect something is listening on 10397, you can check:

On Linux/macOS:

# See if anything is listening
sudo lsof -nP -iTCP:10397 -sTCP:LISTEN

# Or with netstat
netstat -an | grep 10397

On Windows:

netstat -an | find "10397"

From another machine:

# Test if the port responds
nc -zv hostname 10397

If you're running WSO2 products in a distributed setup, 10397 is likely the Thrift port. If you see something else—or nothing—you've found one of the quiet, unassigned corners of the Internet.

Sources and Further Reading

• IANA Service Name and Transport Protocol Port Number Registry
• RFC 6335: IANA Procedures for Port Registration
• WSO2 Documentation: Changing Default Ports with Offset