860

Port 860/tcp is registered with IANA as iscsi with the description "iSCSI" and the reference [RFC7143] — the consolidated iSCSI specification, with RFC 3720 the original 2004 spec — dual-registered on TCP and UDP; this was verified live against the IANA Service Name and Transport Protocol Port Number Registry (assignee IESG, modified 2013-08-27, reference [RFC7143]). The single most important clarification for this port is that 860 is the registered "iscsi" system port but is not the default iSCSI port in practice: RFC 3720 states that the well-known port assigned by IANA for iSCSI connections is 3260 and is the default, that implementations needing a system port number may use 860, but that implementations MUST NOT default to port 860 because 3260 is the only allowed default. The de-facto, overwhelmingly used iSCSI port is therefore 3260 (service name iscsi-target), and FreeBSD historically shipped iscsi 860/tcp and 860/udp in /etc/services, which confused initiators expecting 3260; Cisco switches' iSCSI QoS optimization defines flows for both 3260 and 860 by default, and the related Internet Storage Name Service (iSNS) is on 3205. Functionally, iSCSI carries SCSI block-storage commands over TCP/IP, letting an initiator access a remote target's disk or LUN over the network as if it were a local block device — enabling IP-based SANs without Fibre Channel — with names using the IQN, EUI, or NAA formats (IQN most common). It was specified in RFC 3720 (2004) and consolidated and updated by RFC 7143 (2014), with the default port 3260. Security-wise an exposed iSCSI service means remote block-storage exposure: unauthenticated or weakly authenticated (CHAP-only) targets let an attacker mount, read, and write raw block storage — a severe confidentiality and integrity risk and a known ransomware and data-theft target — so iSCSI should never be internet-exposed and should run on isolated, dedicated storage networks with CHAP (ideally mutual CHAP) plus IPsec, with nmap NSE iscsi-info and iscsi-brute useful for assessment. For an analyst, an open 860 (or 3260) reachable from a general network is a high-priority finding that usually indicates a NAS or SAN target, or an iSCSI initiator, improperly placed on a routable segment; the prevalence of 860 is much lower than 3260.

IANA assignment

iscsi — "iSCSI"; reference [RFC7143] (verified live against the IANA CSV; RFC 3720 was the original 2004 spec); dual-registered 860/tcp + 860/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

low (much lower than 3260); nmap-services de-facto low [Well-established] — nmap-services file

Related ports

3260 (iscsi-target — the real iSCSI port), 3205 (iSNS)

Primary use

SCSI block-storage commands over TCP/IP (IP SAN initiator↔target)

Other/unofficial uses

CRITICAL — the REAL default iSCSI port is 3260 (iscsi-target); 860 is the system-port registration but implementations MUST NOT default to it

Security implications

exposed iSCSI = remote block-storage read/write; unauthenticated/CHAP-only targets are a severe data-exposure/integrity risk and ransomware target; never internet-expose; use isolated storage nets + CHAP (mutual) + IPsec

Typically seen on

NAS/SAN targets, iSCSI initiators (storage networks)

Analyst note

An open 860 (or 3260) reachable from a general network is a high-priority finding — usually a NAS/SAN target or initiator improperly on a routable segment; 860 prevalence is much lower than 3260.