Port 2304: Attachmate UTS — A registered port in quiet retirement

What This Port Is

Port 2304 is a registered port assigned by IANA to attachmate-uts — the network service for Attachmate's UTS (Universal Terminal Service) terminal emulation software.¹

UTS here refers to the Unisys Terminal System, a mainframe environment developed by Sperry (later Unisys). Attachmate built software that let PCs emulate UTS terminals, connecting workers to those mainframes over a network instead of through dedicated serial lines. Port 2304 was the door for that traffic.

Both TCP and UDP are registered for this port, though in practice terminal emulation sessions are connection-oriented and TCP is what you'd actually see.

The Port Range

Port 2304 sits in the registered ports range: 1024 to 49151.

This range works differently from the well-known ports below 1024. Well-known ports (like 80 for HTTP or 22 for SSH) are reserved for fundamental Internet infrastructure and require elevated privileges to bind on most systems. Registered ports are claims — any organization or vendor could register one with IANA for their application. Thousands did.

That means this range is a historical archive. It contains ports for software still running on millions of machines, ports for software that hasn't been updated in a decade, and ports for companies that no longer exist under the names on the label.

The Attachmate Story

Attachmate Corporation was founded in 1982 during the era when connecting a PC to a mainframe was a real, hard problem that companies paid real money to solve. Their terminal emulators — supporting IBM 3270, IBM 5250, DEC VT, and Unisys UTS sessions — ran on millions of corporate desktops.²

In 2005, a private equity group merged Attachmate with its longtime competitor WRQ. In 2014, Micro Focus acquired Attachmate. The products survived the acquisition — they still run UTS emulation, still connect to Unisys systems, still use port 2304. They just do it under a different corporate roof.³

If you're maintaining legacy infrastructure connected to Unisys mainframes, you may legitimately see traffic on this port. For everyone else, it's a quiet corner of the registry.

Checking What's on This Port

If you see activity on port 2304 and want to know what's using it:

On Linux/macOS:

# Show what process is listening on port 2304
ss -tlnp | grep 2304

# Or with lsof
lsof -i :2304

On Windows:

netstat -ano | findstr :2304

The PID in the output can be matched to a process name in Task Manager or with tasklist.

Unless you're running Attachmate/Micro Focus terminal emulation software connecting to a Unisys system, nothing should be listening here. Unexpected activity on unassigned or obscure registered ports is worth investigating.

Why Unassigned Ports Matter

The registered port range is 48,127 ports wide. IANA has assigned formal services to only a fraction of them. The rest are genuinely unassigned — no registered claim, no expected traffic.

This matters for security. Attackers and malware sometimes use high-numbered or obscure ports specifically because they're less likely to be monitored. A process listening on port 2304 on a machine with no mainframe connections is unusual. Unusual is worth a second look.

Baseline your systems. Know what's normally listening. Unassigned or rarely-used registered ports that suddenly show activity are one of the quieter signals that something changed.