Port 2103: Zephyr — The Instant Messenger That Time Forgot

What This Port Does

Port 2103 is part of the Zephyr Notification Service, a distributed messaging and presence protocol developed at MIT as part of Project Athena. Zephyr uses a cluster of three ports together: 2102, 2103, and 2104. Port 2103 specifically handles zephyr-clt, the serv-hm (server-to-host-manager) connection that maintains subscriber state between Zephyr servers and the clients attached to them.

If you see traffic on port 2103, you're almost certainly looking at a university network running Zephyr, or an application that borrowed the port number for unrelated purposes.

The Story

In early 1986, a systems engineer at MIT's Project Athena sat down with two problems that had no good solutions yet:

1. How do you find someone in a distributed computing environment?
2. How do you deliver a lightweight, authenticated message to them in real time?

These problems sound obvious now because we've solved them so many times — ICQ, AIM, XMPP, Slack, Teams. But in 1986, they were genuinely open questions. The Zephyr Development Team (Mark Eichin, Robert French, David Jedlinsky, John Kohl, and William Sommerfeld) built the answer from scratch.

What they created was essentially presence detection and instant messaging, almost a decade before those terms entered common usage. Zephyr let you subscribe to notifications, see who was logged in, and send messages across a distributed Unix campus network. It ran over UDP because reliability mattered less than speed — the same tradeoff that every modern messaging system still makes.

Why It Still Exists

Most of the Internet has moved on. Zephyr has not, at least not entirely.

MIT, Carnegie Mellon, Brown, Iowa State, and the University of Maryland still run Zephyr infrastructure. Decades of institutional inertia, decades of users who prefer it, and an architectural simplicity that has aged surprisingly well. The protocol predates TLS, predates the web, predates the smartphone — and it's still handling messages on campus networks right now.

It's not that Zephyr is better than what replaced it. It's that it works, the people who use it are comfortable with it, and no one has had sufficient reason to turn it off.

The Registered Port Question

IANA lists this port range as "registered" for Zephyr, which means it has an official claim — but that claim carries no enforcement. Any application can open port 2103 for any purpose. The registration just means: if you see something on this port and you're at a university, it's probably Zephyr. If you see it in a corporate environment, it's probably something else entirely.

How to Check What's Listening

# macOS / Linux - show what process has port 2103 open
sudo lsof -i :2103

# Linux alternative
ss -tlnp | grep 2103

# Windows
netstat -ano | findstr :2103

If nothing comes back, nothing is listening on this port — which is the normal state on any machine not running Zephyr or something that deliberately chose this port number.