Port 1988: Cisco RSRB — A Port from the Token Ring Wars

What This Port Does

Port 1988 is officially assigned to Cisco RSRB (Remote Source-Route Bridging), specifically as the medium-priority TCP channel for carrying Token Ring traffic across IP networks.¹

RSRB was Cisco's solution to a real problem in the 1990s: IBM's Token Ring networks were everywhere in enterprise computing, but the world was moving to IP. RSRB let Token Ring frames travel through IP infrastructure by encapsulating them in TCP connections. To manage traffic priorities, Cisco used three consecutive ports:

• Port 1987 — low priority
• Port 1988 — medium priority
• Port 1989 — high priority

It's a tidy design. Each port carried the same protocol, just with different queue treatment on the routers. The ports were registered in sequence, and you can almost see the engineer assigning them finding satisfaction in the consecutive numbers.²

Why It's Mostly Silent Now

Token Ring lost. By the early 2000s, Ethernet had won the LAN wars completely. RSRB went with it. Today, seeing active traffic on port 1988 for its intended purpose would be a genuine rarity — a sign that someone is maintaining very old network infrastructure, or that a Cisco router configuration simply never got cleaned up.

The port exists. The protocol works. There's just almost nothing left for it to do.

The Security Problem

When a legitimate protocol abandons a port number, other things move in.

Port 1988 is associated with Backdoor.Win32.Delf.abb, a trojan that listens on TCP ports 1988 and 2111. The malware communicates in unencrypted plaintext — anyone who can observe the network traffic can read the commands being sent.³ W32.Kipis has also been documented using this port.

This is the risk of any low-traffic registered port: the legitimacy of the assignment provides a thin veneer of normalcy. Port 1988 sounds like it belongs to something real. It does, technically. But whatever is listening there on a modern network almost certainly isn't RSRB.

How to Check What's Listening

If you see port 1988 open on a system, find out what's actually there:

On Linux or macOS:

sudo ss -tlnp | grep 1988
# or
sudo lsof -i :1988

On Windows:

netstat -ano | findstr :1988

The process ID in the output will tell you what's holding the port. If it's not a Cisco RSRB process — and it won't be — you want to know why it's open.

The Honest Summary

Port 1988 is a registered port with a real, documented assignment that nobody uses anymore. The technology it was built for is gone. The port number remains, assigned and valid, in a world that has moved on. What fills that vacuum is mostly silence — and occasionally something you don't want.

If this port is open on your network, investigate it. The odds that you're running active RSRB in 2025 are vanishingly small.