Port 3538: IBM Directory Administration — The Admin Door Behind the Directory

What This Port Is

Port 3538 sits in the registered port range (1024–49151) — the middle third of the port number space, where applications claim addresses they expect to use consistently, even without always holding a formal IANA assignment.

For port 3538, that claim belongs to IBM. IBM Security Directory Server (formerly IBM Tivoli Directory Server) uses port 3538 as its administration server port — the channel through which administrators manage directory instances, separate from the LDAP queries that flow through port 389.¹

The service name you'll find in port databases is ibm-diradm, shorthand for IBM Directory Administration.

Two Ports, Two Conversations

IBM's directory server architecture separates two different kinds of traffic:

• Port 389 (or 636 for LDAPS): Where clients query the directory — authentication requests, user lookups, group membership checks
• Port 3538: Where administrators manage the server itself — starting and stopping instances, configuring replication, monitoring status

This separation makes sense from a security standpoint. You can firewall the admin port more aggressively than the directory port, limit who can reach it, and audit access to it independently. The directory talks to the world on 389. It talks to its administrators on 3538.

Is This Port Formally Assigned?

The IANA registry is ambiguous here. Port databases like SpeedGuide list 3538 as ibm-diradm, and IBM's own product documentation confirms the default.¹² But IBM enterprise software has a long history of using ports consistently without formal IANA registration — the de facto assignment becomes the standard through decades of deployment.

If you're running IBM Security Directory Server and see 3538 open, that's expected. If you're not, it shouldn't be.

Checking What's on This Port

# See what's listening on port 3538
sudo lsof -i :3538

# On Linux, alternative approach
ss -tlnp | grep 3538

# Check from another host
nmap -p 3538 <target-ip>

If port 3538 shows up listening on a machine that doesn't run IBM directory software, investigate. An unexpected listener on any registered port is worth understanding.