396
Summary
- // typical exposure
- Internal-only — NetWare/IP's DSS was designed as a centralized directory service for internal NetWare networks, not for public internet reach, and the underlying protocol is largely retired today.
- // common applications
- Novell NetWare/IP (NetWare 3.x/4.x NLM s Traffic on this port is most often legacy Novell NetWare/IP DSS synchronization or query traffic; no other software has been reported using this port in available documentation.
- // analyst note
- A registered port with a blank IANA reference and no registration date; treat an open 396 as a legacy-NetWare/IP or anomaly signal rather than routine service.
- // if you see it open
- Designed for internal enterprise directory synchronization within a NetWare/IP network, not public internet reach. NetWare/IP is a largely retired 1990s technology; no CVE advisories or dated exposure/scanning studies specific to port 396 were found, and the nmap-services open-frequency for 396/tcp is essentially 0.000000. An internet-facing instance today would be unusual and worth investigating as a legacy deployment, decoy, or misconfiguration.
About port 396/tcp.
Port 396/tcp is registered with IANA as netware-ip for Novell NetWare over IP, and — as a legacy internal enterprise directory service — it should stay internal-only rather than be exposed to the public internet.
IANA's registry lists 396 as dual-registered on TCP and UDP under the description "Novell Netware over IP," with no assignee, contact, RFC reference, or registration date recorded. These blanks reflect gaps in the original registry entry rather than omissions in this write-up.
The protocol behind the assignment is NetWare/IP, Novell's TCP/IP transport for NetWare 3.x and 4.x. Port 396 carries traffic for the DSS (Domain SAP/RIP Server), which replaces native IPX SAP/RIP broadcasts with a centralized directory: clients locate the DSS via DNS, then use UDP/396 for domain-parameter and SAP/RIP queries and TCP/396 for DSS database synchronization.
No software other than Novell's own NetWare/IP client and server stack has been documented using this port. NetWare/IP is a largely retired 1990s technology, and no dated scanning studies or CVE advisories specific to port 396 were found. The nmap-services corpus records 396/tcp at an open-frequency of essentially 0.000000, meaning it is present in the dataset but almost never seen open in real-world scans.
- IANA assignment
netware-ip— "Novell Netware over IP"; reference (blank — no RFC cited in IANA registry); assignee Unknown; dual-registered 396/tcp + 396/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023)
- Prevalence
- nmap-services open-frequency for 396/tcp ≈0.000000 (present in the dataset, zero observed open-frequency) [Confirmed] — this site's own tooling (cached nmap-services dataset)
- Related ports
- 396/udp (dual IANA registration, same
netware-ipname)
Primary use
NetWare/IP DSS (Domain SAP/RIP Server) — centralized directory replacing IPX SAP/RIP broadcasts; UDP/396 for domain-parameter/SAP/RIP queries, TCP/396 for DSS database synchronization
Other/unofficial uses
none documented [Confirmed — absence noted, not fabricated]
Security implications
designed as an internal enterprise service, not for public exposure; largely retired protocol with no port-396-specific CVE or scanning literature located
Typically seen on
legacy Novell NetWare 3.x/4.x NetWare/IP deployments; otherwise anomalous
- Analyst note
- A registered port with a blank IANA reference and no registration date; treat an open 396 as a legacy-NetWare/IP or anomaly signal rather than routine service.
About port 396/udp.
Port 396/udp carries netware-ip, IANA's registered name for tunneling Novell NetWare's IPX-based protocol stack over IP; it is a legacy transition mechanism that should stay internal-only rather than be exposed to the public internet.
IANA's Service Name and Transport Protocol Port Number Registry lists 396 as netware-ip — "Novell Netware over IP" — dual-registered on both 396/tcp and 396/udp, with no RFC or other reference document cited (the registry's Reference field is blank for this entry, not omitted here).
The protocol let legacy NetWare file, print, and directory (NDS) services traverse IP-only networks during the era when NetWare still relied natively on IPX, chiefly pre-NetWare 5 deployments (roughly pre-1998/1999), before Novell moved NetWare itself onto native IP transport. Novell's own technical documentation describes port 396 as carrying DSS (Domain SAP/RIP Server) traffic: clients locate the DSS via DNS, then use UDP/396 for domain-parameter and SAP/RIP queries.
Third-party port-lookup directories (SpeedGuide, tcp-udp-ports.com, portsmaster.net, ports.my-addr.com, auditmypc.com) consistently tie this port to Novell NetWare client-server components, but no independent vendor knowledge base, forum thread, or scanning study naming a different specific application was found. Given NetWare's end-of-life status, these should be read as legacy/historical attributions rather than confirmation of live traffic today.
- IANA assignment
netware-ip— "Novell Netware over IP"; reference blank (no RFC cited); dual-registered 396/tcp + 396/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (local cache: the IANA Service Name and Transport Protocol Port Number Registry, lines 785-786)- Range class
- well-known (0–1023)
- Prevalence
- nmap-services open-frequency for 396/udp ≈0.000379 [Confirmed] — this site's own tooling (cached nmap-services dataset)
- Related ports
- 396/tcp (dual IANA registration, same
netware-ipname)
Primary use
tunnel Novell NetWare's IPX-based protocol stack over IP networks so legacy NetWare traffic could traverse IP-only infrastructure; DSS (Domain SAP/RIP Server) domain-parameter and SAP/RIP queries confirmed on UDP/396 by packet trace
Other/unofficial uses
none confirmed beyond Novell NetWare itself; no independent forum/vendor sighting of a different application found [Unknown]
Security implications
no CVE or scanning/honeypot data specific to 396/udp found; as a legacy internal NetWare-over-IP tunnel it has no public-facing design intent
Typically seen on
legacy Novell NetWare client-server infrastructure (pre-NetWare 5, ~pre-1998/1999)
- Analyst note
- An open 396/udp is a legacy Novell NetWare-over-IP signature; treat as internal/legacy infrastructure and investigate if seen exposed externally.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| netware-ip | UDP | Novell Netware over IP | 0.04% |
| netware-ip | TCP | Novell Netware over IP | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.