Port 2847: AIMPP Port Req — A Reserved Door for a Dead Protocol

What Port 2847 Is

Port 2847 sits in the registered port range (1024–49151). These ports are formally administered by IANA, the Internet Assigned Numbers Authority, which maintains the global registry of which services claim which numbers. Unlike the well-known ports below 1024 (reserved for foundational protocols like HTTP and DNS), registered ports require an application — but they don't require widespread adoption.

Port 2847 is officially assigned. Its registered name: aimpp-port-req, for both TCP and UDP.¹

The Service That Claimed It

AIMPP stands for AIM Presence Protocol — the system underneath AOL Instant Messenger that handled presence negotiation. "Presence" in messaging means the machinery of knowing who's online: the buddy list updates, the away messages, the status changes that made AIM feel alive.

The "-port-req" suffix suggests this was the negotiation half of a two-part system — a port used to request where the actual presence data should flow, rather than carry it directly. Think of it as the handshake before the handshake.

AIM ran primarily on port 5190, which carries the core OSCAR (Open System for Communication in Realtime) protocol.² Port 2847 occupied a more specialized role in AIM's presence infrastructure — registered formally, but never widely documented in public protocol specifications.

The Problem: AIM Is Gone

AOL shut down AIM on December 15, 2017, after twenty years of operation.³ Every buddy list, every away message, every protocol that depended on AIM's servers went dark.

Port 2847 remains registered. The service it was built for does not exist.

This is not unusual. The IANA registry accumulates historical assignments the way a city accumulates old phone numbers — some get reassigned, many just sit. There's no automatic cleanup process. A service dying doesn't free its port claim.

What's Actually on Port 2847 Today

Almost certainly nothing standard. If you see port 2847 active on a system, it is not AIM — and it's worth investigating what's actually there.

On Linux/macOS:

# See what's listening on port 2847
sudo lsof -i :2847

# Or with ss (faster on modern Linux)
ss -tlnp | grep 2847

On Windows:

# Find process using port 2847
netstat -aon | findstr :2847

# Then look up the PID
tasklist | findstr <PID>

If you find something listening here, it's not AIM — it's a process that chose this port for its own reasons, possibly because the port is technically "free" despite being registered.

Why Unassigned (and Abandoned) Ports Matter

The registered port range exists to prevent collisions — to ensure that when two pieces of software both want port 5432, one of them (PostgreSQL) has a legitimate claim. The system works through coordination: you register, others avoid.

When services die and leave their ports registered, those ports enter a gray zone. They're technically claimed, practically empty, and occasionally repurposed by software that either doesn't know the history or doesn't care. Security scanners sometimes flag traffic on registered-but-dormant ports because unexpected activity on named ports is worth noticing.

Port 2847's story is a small lesson in how the Internet's administrative layer outlives the services it was built to support. The registry is permanent. The software isn't.