# WHATPORT(5987)

## NAME

port 5987 — wbem-rmi (WBEM over Java RMI) — A WBEM-over-RMI registration from the DMTF port block, with no meaningful deployment behind it.

Protocol: TCP  
IANA registry

## DESCRIPTION

IANA assigns 5987 to `wbem-rmi`, registered by Jim Davis alongside the rest of the WBEM block (5985-5990). It was intended for a Java RMI binding to a CIM object manager — the approach Sun's WBEM Services used — but CIM-XML over HTTP on 5988/5989 and WS-Management on 5985/5986 are what implementations actually settled on. A listener here is unusual; when it appears it is typically a Java management agent that opened the whole DMTF block, or an unrelated application on a free port.

## EXPOSURE

**Do not expose.** Java RMI endpoints deserialize remote objects and have a long history of remote-code-execution flaws, and this one sits in a hardware-management block — keep it off any untrusted network.

## CHECK

```sh
nmap -Pn -sV -p 5987 TARGET
```

## SEE ALSO

- iana — [IANA port registry — 5987 (wbem-rmi)](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=5987) (iana.org)

---

HTML: <https://whatport.net/5987/> · JSON: <https://whatport.net/5987.json> · full dataset: <https://whatport.net/ports.json>