Port 1987: Cisco RSRB Priority 1 — A Ghost from the Token Ring Era

Port 1987 sits in the registered port range (1024-49151). These ports are not assigned by default to any service — they require an entity to register them with IANA for a specific purpose. Port 1987 has an informal association with Cisco's RSRB system, but carries no official IANA service assignment today.

What RSRB was

In the late 1980s, IBM Token Ring dominated enterprise networking. Before Ethernet won, Token Ring was the serious corporate LAN technology — deterministic, reliable, and everywhere in large organizations.

Token Ring used Source-Route Bridging (SRB), an IBM invention that required every packet to carry the full path it would take through the network. Bridges read these paths and forwarded accordingly. It worked well within a single Token Ring segment. It fell apart when you needed to connect Token Ring networks across a WAN.

Cisco built Remote Source-Route Bridging (RSRB) to solve this. RSRB encapsulated Token Ring frames and tunneled them across non-Token Ring connections — serial links, Ethernet backbones, whatever connected remote offices. Routers on each end would unwrap the frames and present them to local Token Ring segments as if they'd traveled natively.

To manage traffic, Cisco implemented priority queuing for RSRB. Three ports, three priority levels:

Port 1987 carried the highest-priority RSRB traffic.¹

Why you'll never see it

Token Ring is gone. Ethernet displaced it entirely through the 1990s. RSRB became a configuration option that existed for backward compatibility, then quietly faded. Modern Cisco IOS still documents RSRB in its bridging guides, but you would have to go looking for legacy IBM networking gear to find it in use.²

If you see traffic on port 1987 today, it is almost certainly not RSRB. It is more likely:

• A custom application that picked this port arbitrarily
• A development server using a high-numbered port to avoid conflicts
• Something worth investigating if it appears unexpectedly on a production machine

What's actually on port 1987 on your machine

# macOS / Linux - see what's listening
sudo lsof -i :1987

# Linux alternative
sudo ss -tlnp | grep 1987

# Windows
netstat -ano | findstr :1987

If nothing is listening, that's normal. Most ports are empty most of the time.

Why unassigned ports matter

The registered range (1024-49151) exists as a middle ground between the strictly controlled well-known ports (0-1023, which require root/admin privileges to open) and the ephemeral ports (49152-65535) that operating systems assign dynamically for outbound connections.

Applications claim ports in the registered range by convention more than by enforcement. Port 8080 is "HTTP alternate" because enough people use it that way. Port 3306 is MySQL because MySQL picked it and it stuck. Port 1987 never got that kind of adoption — its Token Ring moment passed before the modern Internet fully formed.

It's available. If your application needs a port and 1987 is free on your system, nothing stops you from using it. Just document it clearly so the next person doesn't have to dig through Cisco's legacy bridging documentation to understand why it's there.