# WHATPORT(12000)

## NAME

port 12000 — entextxid (IBM Enterprise Extender) — IBM Enterprise Extender's SNA XID exchange — the first of the 12000-12004 block that carries SNA traffic over IP.

Protocol: TCP/UDP  
IANA registry

## DESCRIPTION

IANA registers 12000 as `entextxid`, "IBM Enterprise Extender SNA XID Exchange", the head of a five-port block: 12001 `entextnetwk`, 12002 `entexthigh`, 12003 `entextmed` and 12004 `entextlow` carry the four SNA classes of service. Enterprise Extender tunnels SNA/APPN over UDP so mainframes and their peers keep talking after the SNA network itself is retired, which is why the live traffic is UDP on 12000-12004 rather than a TCP listener. Nmap's database also carries the legacy alias `cce4x` for ClearCommerce Engine 4.x, a long-defunct payments product. Separately, 12000 is a round number that developers pick constantly for application and API listeners, so on a non-mainframe host it is far more likely to be someone's app server than SNA.

## EXPOSURE

**Do not expose.** Enterprise Extender is a datacenter-to-datacenter transport for mainframe traffic and belongs on private links or a VPN. If instead it is an app server that happened to pick 12000, judge that app on its own terms.

## CHECK

```sh
nmap -Pn -sV -p 12000 TARGET
```

## SEE ALSO

- iana — [IANA port registry — 12000-12004 (entextxid and the SNA COS ports)](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=entext) (iana.org)

---

HTML: <https://whatport.net/12000/> · JSON: <https://whatport.net/12000.json> · full dataset: <https://whatport.net/ports.json>