424
Summary
- // typical exposure
- Internal-only — opc-job-track is a mainframe workload-scheduler status-reporting channel with legitimate use confined to IBM's OPC/ESA product family and no designed public-facing role, so it should never be exposed to the internet.
- // common applications
- IBM OPC/ESAIBM Tivoli Workload SchedulerIBM Workload Scheduler for z/OS Traffic on this port is most often generated by IBM's mainframe workload-scheduling software; OPC/ESA and its successors, IBM Tivoli Workload Scheduler and IBM Workload Scheduler for z/OS, have been reported using it to report job status back to the scheduler.
- // analyst note
- unexpected traffic on 424/tcp outside an IBM mainframe-scheduler environment is anomalous and worth investigating.
- // if you see it open
- No documented CVEs, malware families, or mass-scanning campaigns tied to 424/tcp. Legitimate use is narrowly confined to IBM's mainframe workload-scheduler product line (OPC/ESA and successors); traffic outside that context is anomalous. No source that resolves attributes malware or trojan activity to this port.
About port 424/tcp.
Port 424/tcp carries IANA's opc-job-track service, the status-reporting half of IBM's mainframe workload-scheduling protocol; it is an enterprise management channel that belongs inside a mainframe shop's internal network, not exposed to the public internet.
IANA registers 424 as opc-job-track — "IBM Operations Planning and Control Track" — dual-registered on TCP and UDP, assignee [Conny_Larsson], with a blank Reference field (no RFC governs it). It pairs with port 423/tcp (opc-job-start), the job-initiation half of the same system.
The underlying product is IBM's Operations Planning and Control (OPC/ESA), the z/OS workload-automation (job scheduling) system, later rebranded IBM Tivoli Workload Scheduler and then IBM Workload Scheduler for z/OS. Port 424 reports job state — running, finished, stuck, ready — back to the scheduler.
No CVEs, malware families, or mass-scanning campaigns are documented against 424/tcp. No source that resolves attributes trojan or virus activity to this port.
- IANA assignment
opc-job-track— "IBM Operations Planning and Control Track"; reference (blank — no RFC cited); assignee [Conny_Larsson]; dual-registered 424/tcp + 424/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry (lines 841-842)- Range class
- well-known (0–1023) [Confirmed]
- Prevalence
- nmap-services open-frequency 424/tcp 0.000000 — sampled, not observed open in the scan corpus [Confirmed] — this site's own tooling
- Related ports
- 423/tcp (opc-job-start, paired job-initiation port) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry
Primary use
status-reporting protocol for IBM's OPC/ESA mainframe workload-scheduling system, paired with 423/tcp (opc-job-start)
Other/unofficial uses
none documented beyond IBM's workload-scheduler product line (OPC/ESA → Tivoli Workload Scheduler → IBM Workload Scheduler for z/OS)
Security implications
no documented CVEs, malware, or scanning campaigns [Confirmed negative]
Typically seen on
IBM z/OS mainframe hosts running OPC/ESA or its successors
- Analyst note
- unexpected traffic on 424/tcp outside an IBM mainframe-scheduler environment is anomalous and worth investigating.
About port 424/udp.
Port 424/udp carries opc-job-track, a job-status channel registered by IBM for its mainframe workload-scheduling product line; it is an internal enterprise batch-scheduling protocol and should stay internal-only rather than exposed to the public internet.
IANA's registry lists 424 as opc-job-track, "IBM Operations Planning and Control Track," registered identically on both TCP and UDP with assignee Conny Larsson and a blank Reference column — no RFC documents the protocol.
The name traces to IBM's mainframe scheduler product, historically branded Operations Planning and Control (OPC), later renamed Tivoli Workload Scheduler for z/OS and now IBM Workload Scheduler for z/OS (IWS). The port is best understood as the channel carrying continuous job-status updates — running, finished, stuck — between the central scheduler and the systems it tracks.
Beyond the IBM product family implied by the registry name, no independent reporting, forum discussion, or vendor documentation was found describing other software using 424/udp, and no malware, backdoor, or notable internet-scanning activity is documented against it. Absence of such reporting reflects low visibility for a niche mainframe port rather than confirmed safety.
- IANA assignment
opc-job-track— "IBM Operations Planning and Control Track"; reference (blank — no RFC cited in IANA registry); assignee Conny Larsson; dual-registered 424/tcp + 424/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023) [Confirmed]
- Prevalence
- nmap-services open-frequency 424/udp 0.00061 — sibling 424/tcp is exactly 0.000000 (not observed open), so every observed opening of this dual registration is on the udp side [Confirmed] — this site's own tooling
- Related ports
- 424/tcp (identical registration, dual-registered) [Confirmed]
Primary use
job-status tracking channel for IBM's mainframe workload-scheduling product (OPC / Tivoli Workload Scheduler for z/OS / IBM Workload Scheduler for z/OS)
Other/unofficial uses
none credibly reported [Unknown]
Security implications
no CVE, malware, or scanning activity documented against 424/udp; traffic should remain internal to mainframe scheduling infrastructure [Unknown/Likely]
Typically seen on
IBM mainframe / z/OS environments running OPC-lineage workload schedulers [Likely]
- Analyst note
- an open 424/udp outside a known mainframe scheduling environment is anomalous and worth investigating; legitimate use is narrow and enterprise-specific.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| opc-job-track | UDP | IBM Operations Planning and Control Track | 0.06% |
| opc-job-track | TCP | IBM Operations Planning and Control Track | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.