Port 2289: dict-lookup — The Dictionary's Forgotten Door

What Port 2289 Is

Port 2289 is a registered port — assigned by IANA with the service name dict-lookup and the description "Lookup dict server." It was intended as a companion to the DICT protocol, which lets clients query online dictionary databases over a network connection.¹

The actual DICT protocol, defined in RFC 2229, runs on port 2628. Port 2289 was conceived as a lookup or discovery mechanism — a way to find DICT servers. In practice, this distinction never mattered much. The lookup service on 2289 saw minimal real-world adoption, and the DICT ecosystem as a whole remained a niche corner of Internet infrastructure.

The Registered Port Range

Port 2289 sits in the registered port range (1024–49151). This range is managed by IANA, and services in it are assigned through a formal request process. Unlike the well-known ports (0–1023), registered ports don't require root or administrator privileges to open on most operating systems.

A port being "registered" doesn't mean it's widely deployed. It means someone filled out the paperwork. Thousands of registered ports have service names and almost no implementations running anywhere in the world. Port 2289 is one of them.²

About the DICT Protocol

DICT was designed in the late 1990s to do something sensible: let computers query dictionary databases over a network, the same way they query web servers or DNS. You'd connect to a DICT server, ask for the definition of a word, and get it back — from Webster's, WordNet, or any number of databases the server chose to expose.

RFC 2229 formalized the protocol in 1997. The standard port for DICT queries is 2628. Port 2289 was registered separately for server lookup functionality.³

The protocol works. There are still DICT servers running on the public Internet today. But the use case — fetching dictionary definitions programmatically — found other solutions, and DICT never became infrastructure.

What's Actually Listening Here

Almost certainly nothing, unless you or someone on your network deliberately configured a dict-lookup service. This port sees occasional scanning activity from automated tools probing the address space, but no significant attack surface is known.⁴

To check what's listening on port 2289 on your own machine:

macOS / Linux:

lsof -i :2289

Windows:

netstat -ano | findstr :2289

If nothing comes back, nothing is listening. That's the expected result.

Why Unassigned-in-Practice Ports Matter

The registered port range has over 48,000 entries. Many of them are like port 2289 — formally assigned, rarely or never deployed. This isn't wasted space. It's reservation infrastructure.

When software needs a port, having a registration system prevents two applications from independently choosing the same number and colliding. Even a dormant registration like dict-lookup serves a purpose: it tells a developer writing new software that 2289 is spoken for, even if no one's home.

The gaps and quiet ports also matter for security. Unexpected traffic on a registered-but-unused port often signals something worth investigating — a misconfiguration, a scan, or software behaving unexpectedly.