Port 3470: JT400 Proxy — IBM's Bridge to the Indestructible Machine

What This Port Does

Port 3470 is the default listening port for the JT400 Proxy Server — a component of IBM's open-source Java Toolbox for connecting Java applications to IBM i systems (formerly known as AS/400 and iSeries).¹

Without the proxy, a Java application connecting to an IBM i system opens connections across multiple ports: one for database access, one for remote commands, one for file transfers, one for print queues, and so on. The proxy server collapses all of that into a single port. Clients connect to the proxy on 3470; the proxy handles everything behind it.

The library itself is called JT400 (or JTOpen in its open-source form), and it's been the standard way to talk to IBM i from Java for decades.²

The IBM i Context

IBM i is the operating system that runs on IBM Power Systems — the direct descendant of the AS/400 platform introduced in 1988. AS/400s are notorious for two things: their unusual architecture and their uptime. Stories of AS/400 systems running continuously for ten or fifteen years without a reboot are not myths.

JT400's proxy server exists because connecting a Java application to IBM i involves multiple host servers, each with its own port. For restricted network environments — firewalls, NAT, limited port allowances — opening one port instead of many is a practical win.³

Security Considerations

This port has a notable association: the W32/Mytob.BO worm (a variant of the Mytob family) used port 3470 for its command-and-control communication.⁴ If you see unexpected traffic on 3470 on a system that isn't running JT400, that history is worth knowing.

The SANS Internet Storm Center shows ongoing scan activity targeting this port — automated probes looking for whatever might be listening.⁵

If 3470 is open on a system that has no IBM i connectivity needs, it shouldn't be.

How to Check What's Listening

Linux / macOS:

ss -tlnp | grep 3470
# or
lsof -i :3470

Windows:

netstat -aon | findstr :3470

The process ID in the output will tell you which application owns the port. On Linux, lsof will show the process name directly.

What Range This Port Belongs To

Port 3470 sits in the registered port range (1024–49151). IANA lists the service name as jt400 for both TCP and UDP, though the proxy server itself is TCP-only in practice.⁶

Registered ports don't require the elevated privileges that well-known ports (0–1023) do — any user process can bind to them. IANA maintains the registry to prevent collisions, but registration is voluntary and the list is far from complete.