397

Port 397/tcp carries mptn (Multi Protocol Trans. Net., IBM's Multiprotocol Transport Networking), and it should stay internal-only rather than face the public internet. IANA's live registry lists the service name and description with assignee Soumitra Sarkar, a blank Reference column, and no registration date — the entry is dual-registered on both TCP and UDP.

MPTN is IBM's technology (marketed on the AS/400 platform as AnyNet/400) for carrying legacy SNA/APPC (Advanced Program-to-Program Communication) traffic over TCP/IP rather than over native SNA links. It lets older midrange applications keep using APPC semantics while riding a TCP/IP transport.

Community sourcing (IBM i/AS400 administrator forums and mailing-list summaries) ties observed traffic on this port to IBM i (OS/400/iSeries) systems running AnyNet/400, carrying functions such as SNADS message delivery, STRPASTHR pass-through sessions, and DDM (Distributed Data Management) sessions. The primary midrange-l thread (archive.midrange.com/midrange-l/201601/msg00434.html) returns HTTP 403 on direct access, so this detail cannot be verified against a resolving primary source and is treated as unadopted (sole source returns HTTP 403 on direct access) rather than Confirmed or Likely.

The nmap-services corpus records 397/tcp at an open-frequency of approximately 0.000025, meaning it is present in the dataset but almost never seen open in real-world scans. No scanning or honeypot telemetry (Shodan/Censys/GreyNoise-class data) specific to port 397 was found in the sources checked.

IANA assignment

mptn — "Multi Protocol Trans. Net."; reference (blank — no RFC cited in IANA registry); assignee Soumitra Sarkar; dual-registered 397/tcp + 397/udp [Confirmed] — https://www.iana.org/assignments/service-names-port-numbers/

Range class

well-known (0–1023) [Confirmed] — https://www.iana.org/assignments/service-names-port-numbers/

Prevalence

nmap-services open-frequency for 397/tcp ≈0.000025 [Confirmed] — this site's own tooling (cached nmap-services dataset); no Shodan/Censys/GreyNoise-class scanning/honeypot telemetry specific to 397/tcp found in the sources checked [Confirmed negative]

Related ports

other IBM i / AS400 midrange service ports (e.g. DDM, pass-through, SNADS-related ports); contrast general-purpose service-discovery ports

Primary use

APPC (Advanced Program-to-Program Communication) carried over TCP/IP via IBM's Multiprotocol Transport Networking (MPTN)/AnyNet technology, letting SNA/APPC applications run over TCP/IP

Other/unofficial uses

reported IBM i (AS/400/iSeries) functions riding APPC-over-TCP/IP on this port include SNADS, STRPASTHR pass-through sessions, and DDM sessions; no non-IBM software found associated with this port [Unknown — sole source returns HTTP 403 on direct access] — https://archive.midrange.com/midrange-l/201601/msg00434.html

Security implications

legacy internal SNA/APPC-over-TCP/IP transport for IBM i/AS400 environments; not designed for public-internet exposure; no specific CVE identified

Typically seen on

IBM i / AS/400 / iSeries hosts running AnyNet/400

Analyst note

treat a responsive port 397 as an IBM i/AS400 (AnyNet/400) fingerprint rather than a general-purpose service; verify with banner/host context before assuming APPC traffic.