Port 397 is assigned to MPTN (Multiprotocol Transport Networking), a protocol IBM created to solve a problem that would have cost enterprises millions: how to preserve decades of mainframe application code when the world moved to TCP/IP.1
What MPTN Does
MPTN breaks the binding between applications and network protocols. It lets programs written for one network protocol run over completely different transports without modification.2
On port 397, this specifically means: APPC over TCP/IP. APPC (Advanced Program-to-Program Communication) was IBM's protocol for letting programs on different mainframes talk to each other. It only worked over SNA (Systems Network Architecture), IBM's proprietary network protocol. When the Internet won the protocol wars, enterprises faced a choice: rewrite everything or build parallel networks.
MPTN offered a third option: run the old programs over the new protocol.3
The Problem IBM Solved
In the mid-1990s, enterprises had thousands of applications written for SNA networks. These programs used APIs like CPI Communications and APPC to talk to each other across AS/400 systems, mainframes, and midrange servers. They represented decades of development and billions of dollars of investment.
Then TCP/IP became the standard. Companies wanted to consolidate networks, reduce operational costs, eliminate redundant infrastructure. But rewriting applications wasn't feasible — too expensive, too risky, too time-consuming.
MPTN was IBM's answer: a software-only solution that sits between applications and the network transport layer. The application thinks it's talking APPC over SNA. MPTN translates it to run over TCP/IP. The application never knows the difference.2
How It Works
When an AS/400 application opens an APPC conversation, MPTN intercepts the request. It maps the SNA logical unit (LU) name to an IP address, establishes a TCP connection on port 397, and tunnels the APPC traffic through TCP/IP.3
The receiving system runs MPTN in reverse: it receives the TCP packets, extracts the APPC data, and presents it to the application as if it arrived over SNA.
Both applications continue using their original APIs. No code changes. No recompilation. Just different wires underneath.
Why This Mattered
MPTN (and port 397 specifically) let enterprises phase out SNA networks without abandoning their application investments. You could run AS/400 remote output queues, DDM (Distributed Data Management) functions, and SNDNET commands over the same TCP/IP network carrying your email and web traffic.4
This was IBM's Networking Blueprint strategy: provide a migration path that didn't require forklift upgrades. Let customers reduce the number of logical network transports, cut operational costs, and preserve what worked while adopting what was new.
The Honest Reality
Port 397 is rarely seen in modern networks. MPTN solved a specific problem in a specific era — the transition from proprietary networking to TCP/IP in the 1990s and early 2000s.
Most organizations that needed MPTN have either:
- Completed their migrations and retired SNA entirely
- Replaced their legacy applications with modern equivalents
- Moved to virtualization and cloud infrastructure
But in enterprises still running AS/400 systems (now called IBM i), you might still find port 397 carrying APPC traffic that was first written when Nixon was president.
Security Considerations
MPTN itself provides no encryption or authentication beyond what the underlying protocols offer. APPC traffic over port 397 should be treated as sensitive and restricted to trusted networks.
If you see unexpected traffic on port 397:
- Verify it's from known IBM i or AS/400 systems
- Ensure it's not exposed to the public Internet
- Check if legacy systems are still running that should have been decommissioned
Related Ports
- Port 446: DDM (Distributed Data Management) over TCP/IP
- Port 449: AS-Server Mapper for IBM system communications
- Port 8470-8476: IBM i Navigator and Access services
Checking What's Listening
On Linux/Mac:
On Windows:
Frequently Asked Questions
このページは役に立ちましたか？