Port 60868: Xsan Filesystem Access — Apple's Ghost Protocol

What This Port Carries

Port 60868 exists for Apple's Xsan (Storage Area Network filesystem), a system that lets multiple Mac computers access shared block storage over Fibre Channel networks. When you see this port listening, some Mac somewhere is trying to talk to SAN storage. ¹

The History (and What Happened to It)

Apple introduced Xsan in 2004 as a bold answer to an enterprise question: How can we let Mac systems in a design studio share high-speed storage like big-budget workstations do? ²

For a moment, it made sense. Fibre Channel SANs were expensive and complex. Xsan promised to bring that power to Mac-based creative workflows. TV producers, film editors, graphics teams—people who needed multiple Macs to simultaneously access the same raw files at speed.

But here's what actually happened: The industry moved to Ethernet-based storage (iSCSI, NFS), cloud storage (S3, Google Cloud Storage), and then just... didn't care as much about local SANs. Apple's enterprise vision—Xserves, Xsan, the whole vision—quietly ended. Xserve production stopped in 2011. ³

By 2012, it was clear: Xsan wasn't going to be the future.

Why Port 60868 Still Exists

Port 60868 still sits in IANA's registry because legacy systems exist. Some studios probably still run Xsan. Some institutions built workflows around it a decade ago. The port isn't going anywhere because removing it would break whatever rare deployments still depend on it.

This is how the Internet keeps history. Ports assigned are almost never revoked. They just become ghosts.

How to Check If Something's Using It

If you see port 60868 listening on a Mac:

# Check what's listening on this port
lsof -i :60868

# Or with netstat
netstat -an | grep 60868

Most of the time, you'll find nothing. The port is assigned but largely unused—a reminder of what Apple once tried to be in enterprise computing.

The Bigger Picture

Port 60868 belongs in the dynamic/private port range (49152-65535), which means:

• These ports are reserved for temporary client connections and private services
• Operating systems automatically allocate them to ephemeral connections
• Unlike well-known ports (0-1023) or registered ports (1024-49151), dynamic ports are never supposed to run permanent services

The irony is that port 60868 breaks this rule—it's assigned a permanent service (Xsan) inside the range meant for temporary use. This happened because Apple needed somewhere to put Xsan, and the dynamic range was available. ⁴

Why Unassigned Ports Matter

Most of the dynamic port range goes completely unused. Your system might allocate port 52847 for an outgoing HTTPS connection, then release it. Nobody knows, nobody cares.

But ports like 60868 show that the boundary between "temporary" and "permanent" isn't absolute. Systems can have assigned purposes without being well-known. They can carry important traffic (storage, file access) and still be invisible to most users.

Port 60868 teaches this lesson: Not every important port is famous. Some carry messages to enterprise systems you've never heard of. Some are technically relevant but practically extinct. And some exist primarily to prove that even dead protocols get a place in the registry.