Port 86: mfcobol — Where COBOL Meets the Network

Port 86 is registered to mfcobol, the Micro Focus COBOL networking service¹. It carries traffic for the Micro Focus Directory Server (MFDS), the administration interface that manages Enterprise Server regions, the environments where COBOL programs run on modern infrastructure.

If you've used an ATM today, bought groceries, filed an insurance claim, or checked your bank balance, there's a good chance COBOL code processed that transaction. Port 86 is one of the ways that code gets managed across a network.

What Runs on Port 86

The Micro Focus Directory Server (MFDS) listens on port 86 by default, both TCP and UDP². It provides a web-based administration console, typically accessible at http://localhost:86, for managing Enterprise Server regions: starting and stopping COBOL application environments, configuring services, and monitoring the runtime.

This isn't a data transfer protocol in the way HTTP or FTP moves content. It's an administration and orchestration port. Think of it as the control plane for COBOL workloads running on distributed systems.

On Windows and Linux systems with Micro Focus products installed (Net Express, Server Express, or the modern Visual COBOL and Enterprise Developer suites), you'll find port 86 listed in the system's services file:

mfcobol    86/tcp    # Micro Focus COBOL
mfcobol    86/udp    # Micro Focus COBOL

The Story Behind This Port

To understand why COBOL has a well-known port, you have to understand what COBOL is and what it isn't.

COBOL was born in 1959, designed by a committee that included Grace Hopper, one of the most important figures in the history of computing³. The language was built for business data processing: readable, verbose, and structured around the kinds of operations banks, insurers, and governments needed. Move money. Calculate interest. Print reports. Process claims.

It worked. It worked so well that by the 1970s, COBOL was the dominant language for business computing worldwide. Banks wrote their core systems in it. Governments wrote their tax processing in it. Airlines wrote their reservation systems in it.

Then the world moved on. C arrived. Java arrived. Python arrived. The industry declared COBOL dead approximately once per decade.

COBOL didn't die. It just went underground. As of recent estimates, there are still over 200 billion lines of COBOL in active production⁴. The language processes an estimated 95% of ATM swipe transactions and 80% of in-person transactions. The IRS runs on COBOL. Social Security runs on COBOL. Most major banks run on COBOL.

Micro Focus saw this reality clearly. Founded by Brian Reynolds in a lean-to office alongside his house in Notting Hill, London, on August 12, 1976, Micro Focus set out to bring COBOL off the mainframe and onto smaller computers⁵. Their first product, CIS COBOL (Compact Interactive Standard COBOL), ran on 8-bit microcomputers. In 1981, they became the first company to win the Queen's Award for Industry purely for a software product.

As COBOL systems needed to be networked, managed remotely, and administered across distributed infrastructure, Micro Focus registered port 86 with IANA for their COBOL networking service. The contact on record is Simon Edwards¹. The port gave their Directory Server a stable, well-known address for managing the COBOL workloads that enterprises depended on.

In 2022, OpenText acquired Micro Focus for $6 billion. In 2024, the COBOL business was divested to Rocket Software⁵. The port remains.

Why a Well-Known Port Matters

Port 86 sits in the System Ports range (0-1023), also called well-known ports. These are assigned by IANA through formal review processes and are reserved for established services⁶. Getting a port in this range is significant: it means the service was recognized as important enough to deserve a permanent, low-numbered address that operating systems treat with special privilege.

On Unix-like systems, binding to ports below 1024 requires root or elevated privileges. This is a security mechanism: it guarantees that any service listening on a well-known port was started by a privileged user, not an arbitrary process.

COBOL networking earning a well-known port tells you something about how seriously the industry took COBOL infrastructure, even as popular culture was writing the language's obituary.

Security Considerations

Port 86 has been flagged in some security databases as historically associated with trojan activity⁷. This doesn't mean the mfcobol service itself is malicious. It means that attackers have occasionally used port 86 as a communication channel, likely because it's obscure enough to avoid casual notice but legitimate enough to not immediately trigger alarms.

If you're not running Micro Focus COBOL products, port 86 should be closed. If you are running MFDS, restrict access to trusted management networks only. The administration console should never be exposed to the public Internet.

To check what's listening on port 86:

# Linux/macOS
sudo lsof -i :86
sudo ss -tlnp | grep :86

# Windows
netstat -an | findstr :86

If something is listening and you don't have Micro Focus products installed, investigate immediately.

The Neighbors

Port 86 sits in an interesting neighborhood of early protocol assignments:

Port 88 (Kerberos) is its most famous neighbor, handling authentication for Active Directory environments worldwide. Port 86 is quieter, but no less embedded in infrastructure that matters.