Port 108: SNAGAS — The Mainframe Bridge

Port 108 is assigned to SNAGAS, the SNA Gateway Access Server. It operates on both TCP and UDP, and its job is translation: converting traffic between IBM's Systems Network Architecture and TCP/IP networks.

If that sounds niche, it was. And it mattered enormously.

What SNAGAS Does

The SNA Gateway Access Server is a protocol translator. It sits between two fundamentally different networking worlds: IBM's proprietary Systems Network Architecture (SNA) and the open TCP/IP Internet. Traffic arrives from one side in one language. SNAGAS converts it and sends it out in the other.

On TCP, port 108 handles stateful sessions, the kind of reliable, ordered communication that mainframe terminals expect. On UDP, it handles lighter, connectionless exchanges. Both protocols serve the same purpose: making SNA data travel across IP networks.

The World That Needed This Port

In 1974, IBM introduced Systems Network Architecture¹. SNA was IBM's answer to a hardware problem: their System/370 mainframes could only connect to 4,096 peripherals per CPU, and each communication line counted as one. SNA multiplexed those connections, allowing thousands of terminals to reach a single mainframe.

SNA was brilliant, proprietary, and everywhere. Banks ran on it. Governments ran on it. Airlines ran on it. By the 1980s, SNA networks carried a significant portion of the world's business transactions.

But SNA was not TCP/IP. It had its own layered architecture, its own addressing, its own session management. It was a parallel universe of networking, designed by IBM, for IBM.

As TCP/IP grew from a research project into the backbone of global communication, enterprises faced a problem: their mainframes spoke SNA, but the rest of the world was learning TCP/IP. Someone had to build a bridge.

The Registration

Port 108 was registered with IANA by Kevin Murphy². His email domain, sevens.lkg.dec.com, reveals he worked at Digital Equipment Corporation (DEC), not IBM.

There is something worth sitting with here. DEC, one of IBM's fiercest competitors in the computer industry, registered a well-known port specifically to help IBM mainframes reach TCP/IP networks. This was not charity. DEC sold gateway products. But it was still an act of interoperability: one company building a door so another company's machines could walk through it.

How SNA Gateways Work

An SNA gateway translates between two protocol stacks. On the SNA side, you have VTAM (Virtual Telecommunications Access Method) managing sessions, LU types defining conversation formats, and SSCP (System Services Control Point) managing network resources. On the TCP/IP side, you have sockets, IP addresses, and standard transport protocols.

The gateway encapsulates SNA data streams into TCP or UDP packets. A 3270 terminal session from a mainframe gets wrapped in TCP, sent across an IP network, and unwrapped at the other end. The mainframe never knows it left SNA. The IP network never knows it carried mainframe traffic.

This kind of protocol translation is invisible by design. When it works, nobody notices. When it breaks, an entire bank's teller system goes dark.

Security

Port 108 has been flagged in security databases for historical Trojan activity³. This does not mean the port is inherently dangerous. It means that malware authors, looking for well-known ports that are rarely monitored and rarely filtered, found port 108 useful precisely because so few administrators know what it is.

The SNA Gateway Access Server itself is not a common attack vector. But any open port that nobody is watching becomes an invitation. If port 108 is open on a machine that has no business running an SNA gateway, something is wrong.

To check what is listening on port 108:

# macOS / Linux
sudo lsof -i :108
netstat -tlnp | grep :108

# Windows
netstat -an | findstr :108

Legacy

SNA is not dead, but it is fading. Banks and government agencies still run SNA networks⁴, often because the mainframe applications they depend on were written decades ago and still work. The SNA gateway market peaked in the 1990s as enterprises connected their mainframe infrastructure to corporate intranets and eventually the Internet.

Port 108 belongs to an era when networking meant choosing sides. IBM had SNA. DEC had DECnet. Novell had IPX/SPX. Apple had AppleTalk. Each was a complete, self-contained world. The Internet's triumph was not that TCP/IP was technically superior to all of them. It was that TCP/IP was willing to be the common language, and protocols like SNAGAS were the interpreters that made the transition possible.

Related Ports