Port 60336: Xsan — Apple's storage network, now deprecated

The Range: Dynamic Ports and Borrowed Space

Port 60336 sits in the dynamic/ephemeral port range (49152–65535).¹ This is the zone the Internet Assigned Numbers Authority reserved for temporary, on-demand use. Your operating system reaches into this range when a process needs a port number for outgoing connections—you don't assign these; they get assigned to you.

But here's the catch: just because a port lives in the ephemeral range doesn't mean nothing claims it. Port 60336 has an official assignment.

What Runs Here: Xsan Filesystem Access

Port 60336 is assigned to Xsan, Apple's clustered filesystem technology.² Xsan let multiple Mac computers (and Xserve machines, when those existed) share block storage over Fibre Channel networks. It was built for professional environments: video editing suites, rendering farms, media servers. When you had expensive shared storage, Xsan made it look like a local drive to every connected Mac.

Xsan clients communicate through a range of dynamic ports (49152–65535), but port 60336 specifically handles filesystem access operations.³ Think of it as the conversation layer between your Mac and the shared storage controller.

The Honest Part: It's Deprecated

Apple stopped developing Xsan around 2014. You can still use it on older systems, but Apple's not pushing it anymore. Professional workflows have mostly migrated to all-IP solutions: NFS, SMB, or cloud-based storage.

If you scan your network and find port 60336 open on a Mac, you're looking at infrastructure that's probably ten years old. It's not a security threat. It's archaeology.

How to Check What's Listening

On macOS:

lsof -i :60336
sudo netstat -an | grep 60336

On Linux:

netstat -tuln | grep 60336
ss -tuln | grep 60336

From another machine (if firewall allows):

nmap -p 60336 target-ip

If nothing responds, the port's not in use. If something does, check whether it's a legacy Xsan setup or something else entirely.

Why This Matters

The dynamic port range doesn't mean "no one owns this port." It means the IANA doesn't strictly control what can run here—the range is supposed to be available for temporary use. But services like Xsan claim ports within it anyway, creating a weird legal ambiguity: simultaneously ephemeral and permanent.

This is why port scanning can be confusing. A port that should be temporary according to IANA standards might be permanently claimed by a service you've never heard of. Port 60336 is exactly this kind of hybrid: technically dynamic, actually assigned.

Related Ports

• Port 63146: Another Xsan port that shows up frequently in logs
• Ports 49152–65535: The entire dynamic range where Xsan operates
• Port 3260: iSCSI (alternative for shared storage over IP)
• Port 2049: NFS (NFS alternatives for shared filesystems)