Port 2415: Codima-RTP — A Registered Ghost

What This Port Is

Port 2415 is a registered port — meaning it sits in the 1024–49151 range that IANA maintains as reserved assignments for specific services. Unlike the well-known ports below 1024 (which carry HTTP, SSH, DNS, and the other foundational protocols of the Internet), registered ports are claimed by companies and projects on request.

Port 2415's registered owner: Codima Remote Transaction Protocol, or codima-rtp. It also appears in older registries under the name COMTEST. Both TCP and UDP are listed.

Codima was a network monitoring and management company. The "Remote Transaction Protocol" appears to have been part of their agent-based infrastructure for tracking network performance across distributed systems. The company is no longer active, and the protocol never achieved broader adoption outside their own product line.

The Registered Port Range

Between ports 1024 and 49151 sit roughly 48,000 registered ports. Most carry recognizable services. A meaningful fraction look like port 2415: claimed by a vendor, used briefly or narrowly, then left in the registry when the company wound down or the product was discontinued.

IANA does not reclaim abandoned registrations. The port number sits there indefinitely — reserved on paper, empty in practice.

This is intentional. The alternative (reassigning abandoned ports) creates the risk that old software still listening on a port number would suddenly be talking to an entirely different service. Better to leave the reservation intact.

What Might Actually Be on Port 2415

If you're seeing traffic on port 2415 on a modern system, it is almost certainly not Codima-RTP. The realistic candidates:

• Custom application traffic — Developers and IT teams often pick ports in the registered range for internal services without checking IANA assignments
• Malware — Malicious software occasionally uses obscure registered ports to blend in with legitimate-looking port numbers
• Port scanner noise — Security scanners probe across wide port ranges; seeing a connection attempt here doesn't mean anything is actually using it

How to Check What's Listening

# macOS / Linux — show listening processes on port 2415
sudo lsof -i :2415

# Linux alternative
sudo ss -tlnp | grep 2415

# Windows — show listening ports with process IDs
netstat -aon | findstr :2415
# Then look up the PID:
tasklist | findstr <PID>

If something is listening, the process name will tell you what it actually is.