IBM Enterprise Extender's SNA XID exchange — the first of the 12000-12004 block that carries SNA traffic over IP.
IANA registers 12000 as entextxid, "IBM Enterprise Extender SNA XID Exchange", the head of a five-port block: 12001 entextnetwk, 12002 entexthigh, 12003 entextmed and 12004 entextlow carry the four SNA classes of service. Enterprise Extender tunnels SNA/APPN over UDP so mainframes and their peers keep talking after the SNA network itself is retired, which is why the live traffic is UDP on 12000-12004 rather than a TCP listener. Nmap's database also carries the legacy alias cce4x for ClearCommerce Engine 4.x, a long-defunct payments product. Separately, 12000 is a round number that developers pick constantly for application and API listeners, so on a non-mainframe host it is far more likely to be someone's app server than SNA.
Do not expose
Enterprise Extender is a datacenter-to-datacenter transport for mainframe traffic and belongs on private links or a VPN. If instead it is an app server that happened to pick 12000, judge that app on its own terms.
$ nmap -Pn -sV -p 12000 TARGETSeen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.