Port 60280 — A Door in the Dynamic Range

What This Port Range Is

Port 60280 exists in the dynamic/ephemeral port range: 49152-65535. ¹ This range is not assigned to specific services. Instead, it's reserved for applications to claim temporarily during network sessions. When your system needs to make an outbound connection, it grabs an unused port from this range, uses it for the duration of the communication, and releases it when done.

The IANA designates this entire range as off-limits for permanent service assignments, precisely because it's meant to be fluid. ¹

What Officially Runs Here

Port 60280 has a nominal assignment: Apple Xsan Filesystem Access. ² Xsan is Apple's clustered file system, primarily used in professional media environments. If you encounter this port on an Apple system in an enterprise setting, Xsan is a reasonable guess.

But that assignment is more of a courtesy mention than a guarantee. Any application can request port 60280 when it needs it.

What Actually Runs Here

In practice, port 60280 has been observed carrying:

• Apache Coyote (Java servlet container)
• DVR/surveillance systems
• Generic application traffic in dynamic allocation scenarios

None of these are authoritative. Port 60280 is simply a number that various services have briefly called home. ³

How to Check What's Listening

Use your system's built-in tools to see what's actually bound to this port right now:

Linux/macOS:

lsof -i :60280           # Show what process owns this port
netstat -an | grep 60280 # Show connection state
ss -tlnp | grep 60280    # Modern alternative (ss command)

Windows:

netstat -ano | findstr 60280        # Show PID listening on port
tasklist | findstr [PID]            # Map PID to application

These tools show you what's actually there, not what the RFC says should be there. That's the only honest answer for a dynamic port.

Why Unassigned Ports Matter

The ephemeral range exists because the Internet's communication model requires temporary addresses. Your browser doesn't listen on port 80—it connects from some port in the ephemeral range to a server listening on port 80.

This asymmetry is fundamental: servers need fixed addresses (ports 1-1023 and the registered range 1024-49151). Clients need temporary ones (49152-65535). Port 60280's official non-assignment is actually its entire purpose. It's a placeholder waiting to be claimed.

If port 60280 is listening on your system and you don't recognize the application, the system tools above will tell you exactly what it is. The port itself won't.