887

Port 887 is registered with IANA as iclcnet-svinfo with the description "ICL coNETion server info," assignee Bob Lyon, and a blank reference field on both the TCP and UDP rows (verified against the live registry CSV); the registry carries two entries per transport — the well-formed iclcnet-svinfo and the historic underscore alias iclcnet_svinfo — reflecting RFC 6335 service-name normalization, where the underscore form is retained as historic but is not usable with many common service-discovery mechanisms. It is the companion service to port 886 in the ICL coNETion environment, returning server information; ICL was International Computers Limited, the British mainframe maker later absorbed by Fujitsu and rebranded Fujitsu Services in 2002, and "coNETion" was its 1990s enterprise networking product line. The IANA reference field is blank. As with 886, there is no current standardized protocol or security profile associated with the port, and it reflects a proprietary enterprise stack that has effectively vanished from modern networks. Security-wise there is little specific to defend. For an analyst, an open 887 is legacy and obscure — most likely a forgotten service on very old infrastructure or a misidentified port; some scanner aggregators carry a historical threat flag (W32-family) referenced against 887, which should be treated only as threat-reported, not verified activity. nmap-services lists 887/tcp at roughly 0.000025, which is very low.

IANA assignment

iclcnet-svinfo — "ICL coNETion server info" (plus the historic underscore alias iclcnet_svinfo); reference (blank); assignee Bob Lyon; dual-registered 887/tcp + 887/udp [IANA-assigned, verified live] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

very rare; nmap-services 887/tcp ~0.000025 (de-facto) [Well-established] — nmap-services file

Related ports

886 (iclcnet-locate — companion ICL coNETion service)

Primary use

legacy ICL coNETion server-info service (companion to 886)

Other/unofficial uses

none meaningful [Well-established]

Security implications

no current standardized service; an open 887 is legacy/obscure; scanner aggregators carry a historical W32-family threat flag

Typically seen on

legacy ICL/Fujitsu enterprise environments (effectively none current)

Analyst note

An open 887 is legacy/obscure — identify the actual listening process rather than trusting the registered name.