Port 2387: VSAM Redirector — mainframe data access over TCP/IP

What Port 2387 Does

Port 2387 is assigned by IANA to the VSAM Redirector (vsamredirector), an IBM component used in z/VSE mainframe environments.¹

In practice, you will almost never see this port in the wild unless you work with IBM mainframe infrastructure.

The Port Range

Port 2387 falls in the registered ports range (1024–49151). These ports are formally registered with IANA, meaning an organization or individual has claimed them for a specific purpose. Unlike well-known ports (0–1023), registered ports don't require root or administrator privileges to open, and their services are niche enough that most operating systems don't run them by default.

Having a registered port doesn't mean you'll encounter the service. Many registered ports belong to protocols that are deployed in only a handful of industries or environments. Port 2387 is one of them.

What VSAM Redirector Actually Is

VSAM — Virtual Storage Access Method — is IBM's file access method from the 1960s. It was built for tape drives and disk packs on machines the size of refrigerators, running IBM mainframe operating systems. Decades later, mainframe code written against VSAM still runs in banks, insurance companies, government agencies, and logistics providers around the world. Changing it is expensive. Often, nobody does.

When organizations migrate the data from VSAM files to modern relational databases or file systems, the mainframe programs still expect to talk to VSAM. The VSAM Redirector solves this without touching the programs: a client component on the z/VSE host intercepts outgoing VSAM requests, establishes a TCP connection to a remote VSAM Redirector Server, and forwards the requests to whatever database or file system now holds the data.²

Port 2387 is the door the Redirector Server listens on. The mainframe program has no idea it's talking over a network to a modern system. As far as the old code is concerned, nothing changed.

Checking What's on This Port

If you see port 2387 open on a machine you're responsible for and you're not running IBM mainframe infrastructure, something unexpected is listening there. To investigate:

Linux / macOS:

# See what process is using port 2387
sudo ss -tlnp | grep 2387
# or
sudo lsof -i :2387

Windows:

# Show process using port 2387
netstat -ano | findstr :2387
# Then look up the PID
tasklist | findstr <PID>

An unknown process on a registered port is worth investigating. It could be a misconfigured application, a custom service that picked the port arbitrarily, or — in rare cases — malware that chose an obscure port precisely because it attracts less attention.

Why Unassigned (and Obscure) Ports Matter

The registered port range holds 48,128 ports. Most of them are quiet. Some carry services nobody has run in twenty years. Some carry services running on exactly forty machines in two countries.

This matters for two reasons. First, when you write a networked application and need a port, the registry tells you what's already claimed — so you don't accidentally collide with a Cisco fabric service or an IBM mainframe bridge. Second, when you're investigating network traffic and see an unfamiliar port number, the registry is your first stop. If it's truly unassigned, something chose that number for a reason, and the reason is worth knowing.

Port 2387 isn't unassigned. It's just quiet — a reserved address for technology older than the Internet itself, kept alive by the sheer inertia of production mainframe code that hasn't been touched since before most network engineers were born.