Port 2386: Virtual Tape — An IANA assignment most networks will never use

What This Port Is

Port 2386 lives in the registered port range (1024–49151). These ports are assigned by IANA to specific services upon request, distinguishing them from the well-known ports below 1024 (which are reserved for foundational Internet protocols) and the ephemeral ports above 49151 (which operating systems assign dynamically for outbound connections).

IANA's official assignment: virtualtape / Virtual Tape, TCP and UDP.¹

The Assigned Service: IBM Virtual Tape

The Virtual Tape protocol belongs to IBM's z/VSE operating system — a mainframe OS with roots going back to the 1960s, still running in some banks and enterprises today.

The concept is what it sounds like: instead of writing data to physical tape reels or cartridges, z/VSE can write to virtual tapes — files on a connected PC or server that emulate a tape drive. The VirtualTapeServer process listens on port 2386, accepting connections from the mainframe and handling the tape I/O over the network.²

This is a legitimate and functional service. It's also one that the overwhelming majority of networks will never run.

If You're Seeing This Port

If port 2386 shows up open on your system and you're not running a z/VSE mainframe, the Virtual Tape assignment is not your answer. A few more likely explanations:

• An application chose this port opportunistically. Developers sometimes pick ports in the 2000–3000 range for custom services, databases, or game servers without checking IANA assignments.
• Gaming software from the early 2000s. The 2300–2400 UDP range was used by a cluster of games including Age of Empires II, Flight Simulator 2000/2002, and several GameSpy-based titles.³ If you installed old games, these ports may still appear.
• A development or test service. Local dev environments (Node apps, Python servers, custom daemons) frequently bind to ports in this range during testing.

How to Check What's Using Port 2386

On Linux or macOS:

sudo lsof -i :2386
# or
sudo ss -tlnp | grep 2386

On Windows:

netstat -aon | findstr :2386

Then look up the PID in Task Manager, or:

tasklist /fi "PID eq [PID_NUMBER]"

With nmap (from another machine):

nmap -sV -p 2386 [target-ip]

The -sV flag attempts to identify the service version, which often reveals what's actually running even when it doesn't match the official IANA assignment.

Why Unassigned (or Lightly Used) Ports Matter

The registered port range contains thousands of assignments like this one — technically claimed, rarely deployed. This matters for a few reasons:

Security scanning context. Port scanners flag unexpected open ports. Knowing a port is "assigned to Virtual Tape" tells a security analyst something: if they see port 2386 open on a Linux web server, that's anomalous. The assignment gives you a baseline expectation.

Firewall policy. Most perimeter firewalls block inbound traffic on ports that have no business being open. A port with an obscure legacy assignment that your organization never uses is a port that should be blocked.

Port conflicts. When developers pick arbitrary ports for custom services, they sometimes step on existing assignments. Port 2386 is quiet enough that conflicts are rare, but they happen.