Port 94: Tivoli Object Dispatcher — The Ghost of Enterprise Past

Port 94 is assigned to objcall, the Tivoli Object Dispatcher protocol. It carries inter-process communication for IBM Tivoli Management Framework, an enterprise systems management platform that was, for a period in the late 1990s and 2000s, the nervous system underneath large-scale IT infrastructure.

If you have never heard of it, that is the point. Port 94 managed the machines that managed the machines you actually used.

What the Tivoli Object Dispatcher Does

The Tivoli Object Dispatcher, internally called oserv, is the central process in the Tivoli Management Framework. It runs on every managed node in a Tivoli Management Region (TMR) and handles three responsibilities¹:

1. Maintains the object database on each system where Tivoli is installed
2. Routes object calls to the correct systems and objects across the network
3. Executes methods invoked in the context of objects residing on the local system

Port 94 serves as the listening port for the Tivoli Object Request Broker (ORB). All inter-ORB and inter-TMR communications use port 94 as their destination². When one managed node needs to invoke a method on an object that lives on another node, that call travels through port 94.

The protocol uses both TCP and UDP. TCP provides reliable, ordered delivery for object calls. UDP handles lighter-weight notifications and discovery.

How It Works

The Tivoli Management Framework is built on a distributed object model. Think of it as an early, enterprise-grade version of what we now call service meshes or distributed RPC frameworks.

Every Tivoli-managed system runs an oserv process. When you install Tivoli on a machine, oserv binds to port 94 on all available network interfaces by default. If the system has multiple network interface cards, oserv opens port 94 on each one³.

Object calls flow like this:

1. An administrator (or automated policy) invokes a method on a managed object
2. The local oserv determines where that object lives
3. The call is routed through port 94 to the target system's oserv
4. The remote oserv executes the method and returns the result

The system supports tracing at three levels: errors (default), objcalls (for troubleshooting method invocations), and services (tracking authentication, location, and inheritance requests)⁴.

The Story of Tivoli

Port 94 exists because four people left IBM.

In 1989, Bob Fabbio, Peter Valdes, Todd Smith, and Steve Marcie walked out of IBM Austin with a shared frustration: IBM wanted them to build systems management tools that only worked with IBM hardware. They saw a world filling up with machines from dozens of vendors and believed management software should work across all of them⁵.

They founded Tivoli Systems in Austin, Texas. The name was a placeholder. Todd Smith borrowed it from the system name of an AIX computer at IBM Austin, which may have been named after the Tivoli Gardens in Copenhagen, or possibly the small coastal Texas town of Tivoli. The placeholder stuck⁵.

Tivoli built the Tivoli Management Environment (TME), a cross-platform framework for managing distributed computing infrastructure. It was the right product at the right time. Unix was exploding across the enterprise. Heterogeneous environments were the norm, not the exception. Someone needed to manage all of it.

The company went public on March 10, 1995, opening at $14.00 per share and closing at $30.75, one of the largest first-day run-ups that year⁵.

Then, on March 4, 1996, IBM acquired Tivoli Systems for $743 million⁶.

The irony is precise: four people left IBM because it refused to think beyond its own hardware. They built exactly the cross-platform tool IBM needed. IBM bought them back.

Tivoli's CEO Frank Moss called it "a reverse takeover of IBM by Tivoli." It was not entirely a joke. The acquisition changed IBM's culture, pushing the company toward the software and services model that would define its next two decades⁷.

The Afterlife

Under IBM, Tivoli became a division, then a brand, then a memory:

• 1996: Acquired by IBM, allowed to operate as a subsidiary
• 2002: Tivoli Systems Inc. became Tivoli Software, a brand within IBM Software Group
• 2006: IBM purchased Micromuse for $865 million and folded it into Tivoli
• 2012: IBM held 18% of the IT Operations Management market, driven significantly by Tivoli⁵
• 2013: IBM renamed the Tivoli Software division to "Cloud & Smarter Infrastructure" and began phasing out the brand
• 2018: HCL purchased several former Tivoli products from IBM for $1.8 billion⁵

Through all of this, port 94 remained in the IANA registry, assigned to objcall, listed under Tom Bereiter's name.

Port 94 as a Well-Known Port

Port 94 sits in the well-known port range (0 to 1023). These ports are controlled by IANA and require formal review to assign⁸. Getting a well-known port is a statement: the IETF and IANA considered your protocol important enough to reserve a number in the most privileged range of the entire port system.

Most well-known ports belong to foundational protocols: HTTP on 80, HTTPS on 443, SSH on 22, DNS on 53. Port 94's assignment to an enterprise management framework's internal RPC mechanism is unusual. It speaks to a moment in the early 1990s when distributed object systems were seen as the future of networked computing, important enough to warrant a permanent address in the Internet's most exclusive neighborhood.

Security Considerations

Port 94 should not be exposed to the public Internet. The Tivoli Object Dispatcher was designed for internal enterprise networks. If you see port 94 open on a system:

• It may be running a legacy Tivoli installation
• It has historically been flagged in vulnerability scanners as a potential attack vector
• The protocol was not designed with modern security practices in mind

If you are not running Tivoli Management Framework, nothing should be listening on port 94. If something is, investigate.

How to Check What Is Listening on Port 94

Linux:

sudo ss -tlnp | grep :94
sudo lsof -i :94

macOS:

sudo lsof -i :94

Windows:

netstat -ano | findstr :94

Related Ports