Port 3709: CA IDMS — The Mainframe Database That Outlived Its Era

What Port 3709 Is

Port 3709 is registered with IANA as ca-idms — the TCP/IP entry point for CA IDMS Server, the component that allows modern ODBC and JDBC drivers to connect to CA IDMS databases running on IBM mainframes.¹

If you see port 3709 open on a network scan, you're looking at an organization running one of the oldest continuously maintained database systems in enterprise computing.

What CA IDMS Is

IDMS — Integrated Database Management System — began at B.F. Goodrich in the early 1970s, built on Charles Bachman's network data model from GE's IDS system in the 1960s.² Cullinane Corporation (later Cullinet) commercialized it and sold licenses to some 2,500 organizations by the mid-1980s: the Strategic Air Command, Ford of Canada, Ford of Europe, General Electric, Cleveland Clinic, Bank of Canada, Tesco, and dozens of insurers and financial institutions.³

Computer Associates acquired it in 1989. CA became Broadcom. The database kept running.

IDMS doesn't use the relational model — no tables, no SQL at the core. It uses the CODASYL network model: records connected through sets, with owner records and member records. Programmers navigate the database by walking these relationships explicitly. You don't query it; you traverse it.

This predates SQL. It predates most of the assumptions modern developers hold about how databases work.

Why Port 3709 Exists

For decades, IDMS ran entirely inside mainframe batch jobs and CICS transactions — no TCP/IP required. The CA IDMS Server component (the process IDMSJSRV) was added to let client applications connect over a network using standard ODBC and JDBC drivers.⁴

Port 3709 is the default because of a deliberate convention: 37 + system number. A single-system shop listens on 3709 (37 + 09, the default system number). Organizations running multiple IDMS systems derive their ports from the system number — system 81 listens on 3781, system 99 on 3799.⁵ It keeps things predictable when you're managing mainframe infrastructure.

The Range It Lives In

Port 3709 falls in the registered port range (1024–49151). These ports are formally registered with IANA for specific services, but unlike well-known ports (0–1023), they don't require elevated privileges to open and aren't universally blocked at firewalls.

The registered range is where the Internet's long tail lives — thousands of applications, enterprise systems, and protocols that most people never encounter but that keep specific industries running.

Who Uses This Port

Organizations that haven't migrated away from their IDMS databases — which is more common than the modern developer community tends to assume. When a bank has been running the same CODASYL database for 40 years without data loss, the business case for replacing it is thin.

If you're doing a network audit and encounter port 3709, you're likely inside a financial institution, insurer, government agency, or large retailer that still has active IDMS workloads.

Checking What's on This Port

To see if something is listening on port 3709:

# On Linux/macOS
ss -tlnp | grep 3709
lsof -i :3709

# On Windows
netstat -ano | findstr :3709

# From another machine (check if port is open)
nc -zv <hostname> 3709

If port 3709 is open and you have IDMS credentials, connection is through a standard JDBC URL:

jdbc:idms://<host>:3709/<dictionary>

Security Consideration

CA IDMS Server should not be exposed to the public Internet. If you find port 3709 open on an external scan, it's a misconfiguration — IDMS authentication predates modern security assumptions, and the attack surface of a 50-year-old mainframe database exposed to the open Internet is not something you want to discover the hard way.