Port 1994: Cisco STUN — The High-Priority Lane for Legacy IBM Traffic

Port 1994 is assigned to Cisco STUN — Serial Tunnel protocol — specifically as the high-priority TCP channel. It's not a household name, and you'll never encounter it in a modern deployment. But it represents something important: the messy, unglamorous work of keeping the old world running while the new one was built.

What STUN Does

In the 1980s, IBM mainframes and AS/400 systems dominated enterprise computing. They didn't speak TCP/IP. They spoke SDLC — Synchronous Data Link Control — a link-layer protocol IBM developed in the 1970s for point-to-point and multipoint communication between mainframes and their terminals and controllers.

SDLC worked fine on private leased lines. Then the Internet happened. Enterprises wanted to consolidate their expensive private WAN infrastructure onto IP networks — but they couldn't just replace every IBM terminal, front-end processor, and cluster controller overnight. Those systems cost millions. They worked. They ran critical payroll, inventory, and banking applications.

Cisco's answer was Serial Tunnel (STUN): encapsulate SDLC frames inside TCP/IP, carry them across an IP network, and deliver them to the destination as if the serial link still existed. The IBM equipment never knew the difference.¹

The Four Ports

Cisco allocated four TCP ports to STUN, one per traffic priority:

Port 1993 is absent from the sequence. No official explanation exists for the gap.²

Port 1994 — the high-priority channel — carries time-sensitive SDLC traffic that can't afford to wait in a queue behind bulk transfers. In IBM environments, that typically meant interactive terminal sessions: a user sitting at a 3270 terminal, waiting for a response from the mainframe.

Who Used This

STUN was most commonly deployed in two scenarios:

FEP to remote controller. IBM's Front-End Processors (like the 3745) connected to remote cluster controllers (like the 3174) over leased lines. STUN let enterprises replace those leased lines with IP WAN links while keeping every device in place.

AS/400 to remote controller. Same idea, different IBM product line. The AS/400 (now IBM i) had its own network of SDLC-connected devices that needed a migration path.³

Is This Port Still in Use?

Almost certainly not in any new deployment. SDLC is a dead protocol. IBM mainframes and AS/400 systems that survived into the 2000s and beyond migrated to TCP/IP natively. The last STUN configurations were almost certainly decommissioned years ago.

If you see traffic on port 1994 today, it is not Cisco STUN. Check what's actually listening.

How to Check What's Using This Port

# macOS / Linux — show what process is listening on port 1994
sudo lsof -i :1994

# Linux alternative
sudo ss -tlnp sport = :1994

# Windows
netstat -ano | findstr :1994
# Then check the PID:
tasklist /FI "PID eq <pid>"

If something is listening on port 1994 on a modern system, treat it as suspicious until proven otherwise.