Port 2713: Raven Trinity Broker — A Ghost in the Registry

What Port 2713 Is

Port 2713 sits in the registered ports range (1024–49151). These ports don't belong to the foundational Internet infrastructure like the well-known ports below 1024, but they aren't wild and unclaimed either. Organizations and developers register them with IANA to stake a claim: this service lives here.

Port 2713's claim is held by Raven Trinity Broker Service — service name raventbs, assigned for both TCP and UDP. Its neighbor, port 2714, was registered at the same time for Raven Trinity Data Mover (raventdm).

That's where the trail ends.

The Ghost Registration

Raven Trinity appears to have been a distributed systems or messaging product — a broker handling communication between components, paired with a data mover doing the transport work. This two-port pattern (a coordination service alongside a data transfer service) is common in enterprise middleware architecture.

Whatever Raven Trinity was, it hasn't left much behind. No active website. No surviving documentation. No open-source repository. The IANA registration remains, but registrations don't expire when software does. The port has a name. The software has a grave. ¹

This is more common than you'd think. The IANA registry contains hundreds of ports registered for products that haven't shipped a release in a decade, companies that were acquired and folded into something else, or academic projects that ended when the grant did. The registry is a fossil record of software ambitions.

What This Port Range Means

Registered ports (1024–49151) require no elevated privileges to bind on most operating systems — unlike well-known ports below 1024, which typically require root or administrator access. Any application can open port 2713 without special permission.

This matters for two reasons:

Legitimate software sometimes squats on registered ports without formal registration, using whatever port happens to work. Port 2713 may be occupied by something entirely unrelated to Raven Trinity on any given machine.

Malicious software also prefers this range for the same reason — no privileges needed, and the ports are numerous enough to avoid easy detection by name.

Checking What's Actually Listening

If you see traffic on port 2713, the name "Raven Trinity" tells you nothing useful. Check what's actually running:

On Linux/macOS:

# Show what process is listening on port 2713
sudo lsof -i :2713

# Or with ss
sudo ss -tlnp sport = :2713

On Windows:

netstat -aon | findstr :2713

The PID in the output can be cross-referenced in Task Manager or with tasklist /fi "PID eq <PID>".

Why Unassigned (and Ghost) Ports Matter

The port numbering system works because most software respects it. When a service reliably lives at a known port, firewalls can be written, documentation can be trusted, and network administrators can reason about traffic.

Ghost registrations like port 2713 create ambiguity. The port has a registered name, so it's not truly unassigned — but the software is gone, the name means nothing, and the port is practically available for anyone to claim by squatting.

This is the unglamorous reality of the registered port space: it was designed for coordination, but coordination requires ongoing participation. Software dies. Registrations don't. The result is a registry that's part living standard, part museum, part fiction.