423
Summary
- // typical exposure
- Internal-only — This is a mainframe job-scheduler control channel (IBM OPC/TWS for z/OS) meant to operate within the enterprise datacenter network, not a service designed for or tolerant of public internet reach.
- // common applications
- IBM Operations Planning and Control (OPCIBM Tivoli Workload Scheduler for z/OSIBM Workload Scheduler for z/OS Traffic on this port is most often IBM mainframe job-scheduling control signaling; IBM Tivoli Workload Scheduler for z/OS (the descendant of OPC) is likely to use this port to trigger scheduled batch jobs, paired with port 424 for job-status tracking.
- // analyst note
- an internet-facing 423/tcp would be anomalous for a mainframe internal control protocol and worth investigating as misconfiguration rather than normal service.
- // if you see it open
- Internal enterprise mainframe job-scheduling control channel (IBM OPC / Tivoli Workload Scheduler for z/OS lineage). No CVE, malware family, or backdoor tooling found associated with this port, and no community-sourced sightings of unrelated software. As a mainframe internal control protocol it should never be reachable from the public internet.
About port 423/tcp.
Port 423/tcp carries opc-job-start, IBM's job-start signaling channel for mainframe batch scheduling; it is an internal enterprise control protocol and should never be exposed to the public internet.
IANA registers 423/tcp and 423/udp as opc-job-start, "IBM Operations Planning and Control Start," with no RFC or reference document cited and no assignee or contact listed in the public registry entry [Confirmed].
The registration traces to IBM's OPC (Operations Planning and Control) mainframe batch scheduler, which evolved into IBM Tivoli Workload Scheduler for z/OS and later IBM Workload Scheduler for z/OS [Likely]. Port 423 (job-start) pairs with port 424 (opc-job-track, job-status monitoring) as the start/track control-loop for triggering and watching scheduled batch jobs on z/OS systems [Likely].
No CVE, malware family, or backdoor tooling was found associated with this port, and no community-forum or scanning-writeup sightings attribute traffic on 423/tcp to any software outside the IBM OPC/TWS lineage. nmap-services records a real, very low open-frequency figure for this port (see Fields); no dated Shodan-style exposure statistics were located.
- IANA assignment
opc-job-start— "IBM Operations Planning and Control Start"; reference (blank — no RFC cited in IANA registry); assignee/contact Unknown; dual-registered 423/tcp + 423/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023)
- Prevalence
- nmap-services open-frequency 423/tcp 0.000013 (paired 423/udp is 0.000329, roughly 25x the tcp side); no dated Shodan-style exposure statistics located for this port [Confirmed / Unknown] — this site's own tooling
- Related ports
- 424/tcp (
opc-job-track, the paired job-status/monitoring port) [Confirmed] — IANA registry
Primary use
mainframe batch job-start signaling for IBM's Operations Planning and Control (OPC), ancestor of IBM Tivoli Workload Scheduler for z/OS / IBM Workload Scheduler for z/OS; pairs with 424/tcp (opc-job-track)
Other/unofficial uses
none found; no community-sourced sightings of unrelated software using this port [Unknown]
Security implications
internal enterprise mainframe scheduling control channel; no CVE or malware association found; should stay off the public internet
Typically seen on
IBM z/OS mainframe environments running OPC-descended workload schedulers [Likely]
- Analyst note
- an internet-facing 423/tcp would be anomalous for a mainframe internal control protocol and worth investigating as misconfiguration rather than normal service.
About port 423/udp.
Port 423/udp is registered with IANA as opc-job-start for IBM Operations Planning and Control Start, a mainframe batch-job workload-scheduling protocol, and it should stay internal to the enterprise network rather than be exposed to the public internet.
The IANA registry lists this service name and description under both TCP and UDP (dual registration), with the Assignee, Reference, Registration Date, and Contact fields all left blank — the registry gives no RFC, no responsible-party name, and no assignment date for this entry, and none should be invented.
The product context comes from IBM's own documentation: "OPC" (Operations Planning and Control) was IBM's mainframe workload-automation product, later rebranded IBM Tivoli Workload Scheduler for z/OS and now marketed as IBM Workload Scheduler for z/OS. Port 423 (job-start signaling) is paired with the neighboring port 424 (opc-job-track, job-tracking) in the same product family — this is legacy enterprise mainframe tooling, not a general internet service.
Internet background-scanning data (SANS Internet Storm Center) shows only low-volume, scattered-source activity on this port with an overall "green" (low) threat level as of the 2026-08-05 check date, consistent with generic internet noise rather than a targeted campaign. No specific malware family or unrelated third-party application (games, P2P clients, etc.) was found credibly tied to port 423.
- IANA assignment
opc-job-start— "IBM Operations Planning and Control Start"; reference (blank); assignee (blank); dual-registered 423/tcp + 423/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry, lines 839-840; https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=423- Range class
- well-known (0–1023) [Confirmed] — IANA port-number ranges convention
- Prevalence
- nmap-services open-frequency 423/udp 0.000329 (paired 423/tcp is 0.000013, roughly 25x lower); IANA registry carries no prevalence figure of its own; SANS ISC shows only low-volume, "green" (low) background scanning as of 2026-08-05[Confirmed / Likely] — this site's own tooling, https://isc.sans.edu/data/port/423
- Related ports
- 424/tcp+udp (
opc-job-track, job tracking, same product family) [Likely] — https://www.connected.app/ports/424
Primary use
IBM Operations Planning and Control (OPC) job-start signaling — mainframe batch-job workload automation, later IBM Tivoli Workload Scheduler for z/OS / IBM Workload Scheduler for z/OS
Other/unofficial uses
none found beyond the IBM OPC/Workload Scheduler product line; no source attributes non-IBM software to this port [Unknown]
Security implications
internal mainframe scheduling protocol, not designed for public exposure; no documented CVE or specific malware family tied to this port
Typically seen on
enterprise/mainframe environments running IBM OPC or IBM (Tivoli) Workload Scheduler for z/OS
- Analyst note
- A responsive 423/udp outside a known IBM mainframe environment is unusual and worth confirming against known infrastructure rather than assumed benign.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| opc-job-start | UDP | IBM Operations Planning and Control Start | 0.03% |
| opc-job-start | TCP | IBM Operations Planning and Control Start | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.