Port 1996: Cisco tr-rsrb-port — A Token Ring Relic

Port 1996 is registered with IANA under the name tr-rsrb-port — short for Token Ring Remote Source-Route Bridging port. It belongs to Cisco, and it tells a story about a network war that ended thirty years ago.

What This Port Does

When RSRB is configured to use TCP encapsulation, Cisco routers establish a TCP connection on port 1996 to carry Token Ring frames across IP networks. ¹ The router on one end wraps Token Ring traffic in TCP/IP datagrams; the router on the other end unwraps them and hands them back to the Token Ring segment.

The result: two Token Ring networks in different cities could communicate as if they were directly connected, even though the path between them was an ordinary IP network.

The War This Port Was Built For

To understand port 1996, you need to know that Ethernet almost didn't win.

In the 1980s and early 1990s, IBM's Token Ring was a serious competitor to Ethernet. Token Ring networks passed a "token" around a ring topology — only the device holding the token could transmit, which meant no collisions and more predictable performance. IBM pushed it hard. Many enterprises bet on it.

Token Ring networks used Source Route Bridging (SRB) — a protocol where the sending device itself figured out the full path to the destination and embedded that path in every frame. ² Routers just followed instructions.

Cisco's Remote SRB (RSRB) extended this to let Token Ring networks on opposite sides of an IP WAN communicate. One router would encapsulate the SRB traffic into TCP/IP; port 1996 is where those TCP connections landed.

Then Ethernet won. Fast Ethernet arrived, switched Ethernet eliminated collisions, and the performance arguments for Token Ring evaporated. By the late 1990s, Token Ring was in retreat. By the 2000s, it was effectively dead.

Port 1996 outlived the protocol it was built for.

Where Things Stand Today

Cisco eventually replaced RSRB with DLSw+ (Data Link Switching Plus), which Cisco described as its "strategic method" for connecting Token Ring and SNA networks over IP. ¹ DLSw+ is itself now legacy. Token Ring is a museum piece.

If you see port 1996 active on a modern network, it's almost certainly not RSRB. It's either:

• A legacy Cisco device in an environment that hasn't been modernized
• An application that chose this port without knowing its history
• Something worth investigating

How to Check What's Listening

On Linux or macOS:

# Show all listening TCP ports and which process owns them
sudo ss -tlnp | grep 1996

# Or with netstat (older systems)
sudo netstat -tlnp | grep 1996

# Or with lsof
sudo lsof -i :1996

On Windows:

netstat -ano | findstr :1996

The process ID (PID) in the output lets you look up the process name in Task Manager or with tasklist.

Why Registered Ports Like This Matter

The registered ports range (1024–49151) exists as a kind of reservation system. IANA assigns these numbers to specific services so that different applications don't accidentally collide. ³

Port 1996's registration means no other application should be officially using it — but "officially" is doing real work in that sentence. Unofficial software uses whatever port it wants. The registration just prevents another standard from claiming the number.

A reserved-but-dormant port like 1996 is also a common target for malware that wants to blend in. Something listening on an obscure registered port looks less suspicious than something on a random high port. If you see unexpected activity here, investigate it.