Port 399: ISO-TSAP-C2 — The Bridge Between Protocol Worlds

Port 399 carries ISO Transport Class 2 Non-use of Explicit Flow Control over TCP. That's a mouthful. What it means: this port exists because two networking worlds collided in the 1990s, and someone had to build a bridge.

What It Does

Port 399 implements ISO 8073 Transport Class 2 running on top of TCP.¹ It's defined in RFC 1859, published in October 1995.

Here's the situation it was designed to solve: ISO (the International Organization for Standardization) had their own network protocol stack — the OSI model everyone learns in networking class. Meanwhile, TCP/IP was winning. Actually winning. The Internet was built on TCP/IP, not on ISO protocols.

But companies had spent real money on ISO-based systems. Those systems couldn't just disappear overnight. They needed a way to keep running in a TCP/IP world.

Port 399 is that bridge. It lets ISO Transport Class 2 applications communicate over regular TCP connections.

How It Works

TCP is stream-oriented — it's a continuous flow of bytes with no built-in message boundaries. ISO transport protocols expect discrete packets with clear boundaries.²

RFC 1859 solves this by adding a simple packetization scheme on top of TCP. It wraps ISO Transport Protocol Data Units (TPDUs) so they can travel through TCP's byte stream without getting lost or merged together.

When a host wants to establish an ISO transport connection using port 399, it performs a standard TCP connection to the remote host on port 399. Once connected, ISO transport messages flow through that TCP pipe, translated in both directions.

The History: A Standards War

In the 1980s and early 1990s, there was a genuine question about which protocol stack would power the future Internet. The ISO/OSI model was backed by international standards bodies and many governments. TCP/IP was scrappier, simpler, already deployed.

TCP/IP won. Not because it was theoretically superior — arguments still rage about that — but because it worked, it was free, and it was already running on the networks that became the Internet.

But the transition wasn't instant. RFC 1006 (published in 1987) originally defined how to run ISO Transport Class 0 over TCP.³ RFC 1859 extended that work to support Class 2, which adds multiplexing capability — the ability to run multiple transport connections over a single network connection.

These RFCs weren't about making ISO protocols better. They were about keeping them alive long enough for organizations to migrate away.

Why Port 399 Matters

Port 399 represents a specific engineering philosophy: build bridges, not walls. When your protocol is losing the standards war, you don't force everyone to rip out their infrastructure. You build adapters. You create compatibility layers. You buy time.

This port is rarely used today. The ISO protocol stack has mostly faded into history, replaced by the TCP/IP suite that powers the modern Internet. But for a crucial period in the 1990s and early 2000s, port 399 kept legacy systems running while the world transitioned.

It's a monument to pragmatism over purity.

Security Considerations

Port 399 itself has no inherent security features. It's a transport-layer bridge, not a security protocol. If you're running services on port 399, you're responsible for securing the ISO transport layer and the application layer above it.

In practice, if you see port 399 in use on a modern network, it's likely supporting very old legacy systems. Those systems may have security vulnerabilities simply due to age and lack of updates. Audit carefully.

Related Ports

• Port 102: ISO-TSAP (ISO Transport Service Access Point) Class 0 — the simpler, older version that RFC 1006 originally defined³
• Ports 0-1023: System Ports — the well-known port range where IANA assigns services that require privileged access

Checking What's Listening

To see if anything is listening on port 399 on your system:

Linux/Mac:

sudo lsof -i :399
netstat -an | grep 399

Windows:

netstat -ano | findstr :399

If you find something listening on port 399, it's almost certainly a legacy system running ISO transport protocols. Document what it is and why it exists — that knowledge may not be written down anywhere else.