Port 246 is assigned to dsp3270 (Display Systems Protocol), a bridge protocol created in 1980-81 when the mainframe world collided with packet-switched networking.1
What It Does
The Display Systems Protocol connects IBM 3270 terminals to hosts across X.25 packet-switched networks.2 The "3270" refers to the IBM 3270 family—terminals and printers designed to talk to mainframes using bisynchronous communication (BSC). The problem: X.25 packet networks weren't designed for 3270 terminals, and 3270 terminals weren't designed for packet networks.
Port 246 carries the protocol that makes them work together anyway.
How It Works
DSP operates as a layer-4 protocol sitting above X.25's layer 3.2 Two Packet Assembler-Disassemblers (PADs) act as translators: one connects to the 3270 terminal, the other to the mainframe host.
Here's the clever part: the terminal-side PAD pretends to be a host computer. It handles all the BSC polling locally instead of sending poll requests across the network. From the terminal's perspective, it's talking to a host in the next room. From the host's perspective, it's talking to a nearby controller. Neither knows they're separated by a packet-switched network.
The PADs transmit data and control information through X.25 DATA packets, using the Q bit to distinguish control messages. This makes efficient use of the network by eliminating the constant polling that BSC requires.
The Origin Story
In 1980-81, four telecommunications companies—GTE Telenet, Transcanada Telephone, Tymnet, and Comtan—collaborated to create DSP.3 This wasn't a standards committee or academic project. It was companies solving a customer problem: organizations had invested heavily in 3270 terminals, but they wanted to use modern packet-switched networks.
The CCITT standards (the precursor to ITU-T) didn't support 3270 terminals on X.25 networks. So these companies built the protocol themselves and registered it with IANA as port 246.4
The Context
The IBM 3270 was released in 1971 to replace the IBM 2260.3 It was designed for efficiency: by handling input locally and only transmitting complete screens, a 1970s-era IBM 3033 mainframe with just 16 MB of memory could support up to 17,500 3270 terminals under CICS.
By 1980, packet-switched networks like X.25 were becoming common, but they operated fundamentally differently than the synchronous protocols 3270 terminals expected. DSP bridged that gap, making packet switching transparent to both terminals and hosts.
Modern Status
Port 246 remains officially assigned to dsp3270 in IANA's registry.1 However, this is largely a historical assignment. X.25 networks have mostly disappeared, replaced by TCP/IP. IBM no longer manufactures 3270 terminals, though mainframe applications still exist and are typically accessed via TN3270 (Telnet 3270) emulators over modern networks.
The protocols that defined mainframe connectivity have moved to different ports and different architectures, but port 246 stands as a marker of when two incompatible technologies needed to talk to each other—and engineers made it happen.
Security Considerations
Because DSP is effectively obsolete and tied to legacy X.25 networks, port 246 is rarely used for legitimate traffic on modern networks. Some security databases have noted that port 246 TCP has been associated with trojans in the past,5 though this likely reflects opportunistic malware using an obscure, unmonitored port rather than any inherent vulnerability in the protocol itself.
If you see unexpected traffic on port 246, investigate it—legitimate DSP traffic is extremely rare in contemporary networks.
Checking Port 246
To see if anything is listening on port 246:
Related Ports
- Port 23 - Telnet, the original remote terminal protocol
- Port 992 - Telnet over TLS
- Port 3270 - No relation; RFC 3270 defines MPLS, not terminal protocols
Frequently Asked Questions
Was this page helpful?