What Is Port 2849?
Port 2849 sits in the registered ports range (1024–49151). These ports are assigned by IANA upon application from developers or organizations that want an official home for their protocol. Unlike the well-known ports below 1024 (HTTP at 80, SSH at 22), registered ports don't come with universal recognition or firewall special treatment. They're official, but they're not essential infrastructure.
According to third-party port databases that mirror IANA data, port 2849 is assigned to FXP — the File eXchange Protocol.1
What Is FXP?
FXP is a technique for transferring files directly between two FTP servers without routing the data through the client.2 Normally, when you download something via FTP and upload it somewhere else, the data travels:
With FXP, a client that has authenticated to both servers can instruct them to connect directly:
The practical use case: a sysadmin with a slow home connection needs to move large files between two high-bandwidth data center servers. FXP lets the servers do the heavy lifting while the admin's laptop just issues the commands.
Why You'll Never See Port 2849 in Use
Here's the thing: FXP doesn't actually need its own port.
The protocol works by leveraging the existing FTP data connection mechanism. Both FTP servers communicate using standard FTP ports (typically 20 and 21). Port 2849 appears in the registry, but FXP never required a dedicated listener — it was an extension of FTP behavior, not a separate service.
And then FXP largely died anyway.
FXP enabled a well-known exploit called the FTP bounce attack.3 By instructing an FTP server to open a data connection to an arbitrary address and port, an attacker could use a trusted server as a proxy to port-scan internal networks or deliver payloads. This was serious enough that most FTP server software disabled FXP support by default. A protocol disabled before it was widely adopted doesn't develop a port culture.
The result: port 2849 sits in the registry, attached to a protocol that most servers won't run, doing nothing.
How to Check What's Using Port 2849
If you see traffic on port 2849, it's almost certainly not FXP. Check what's actually listening:
On Linux/macOS:
On Windows:
If something is listening, note the process ID and look it up. Unassigned or rarely-used registered ports sometimes get picked up by custom applications, internal tools, or — less benignly — malware that chose an obscure port precisely because no one monitors it.
Why Unassigned Ports Matter
The registered port range contains over 48,000 possible ports. IANA has assigned names to thousands of them, but many assignments are dormant — registered by projects that never shipped, protocols that were superseded, or services that quietly disappeared. Port 2849 is a mild example of this: officially registered, practically unused.
This matters for network security. Firewalls typically allowlist by port. An unmonitored registered port is a potential foothold for anything that wants to communicate without attracting attention. Not every unassigned port is dangerous, but every unexplained listener deserves a question.
Беше ли полезна тази страница?