Port 2996: vsixml — Registered, Forgotten

The Registered Port Range

Port 2996 sits in the registered port range (1024–49151), also called the user port range. IANA maintains this space for services that want an official home — a reserved number that, in theory, belongs to one protocol and one protocol only.

Unlike the well-known ports (0–1023), registered ports don't require the same level of technical justification to claim. An organization submits a request, IANA records it, and the port is theirs. Whether anyone actually uses it is another matter.

What Is vsixml?

According to the IANA Service Name and Transport Protocol Port Number Registry¹, port 2996 is assigned to a service called vsixml, registered to someone named Rob Juergens at a company with the domain vsi.com. The registration covers both TCP and UDP.

That's essentially all that's known publicly. There is no RFC. No specification. No documentation. No Wireshark dissector. No Stack Overflow question asking why vsixml stopped working. The name suggests an XML-based service from a company called VSI, but the company's purpose and the protocol's design never made it into any publicly accessible record.

This isn't unusual. The registered port space contains many entries like this: protocols that were registered during development or early deployment, then abandoned, acquired, or simply forgotten before anyone outside the company ever used them.

What's Actually Listening Here

In practice, port 2996 is typically quiet. If you find something listening on it, it's almost certainly a local application — a development server, a database, a custom internal tool — that chose this port because it was available, not because it implements vsixml.

To check what's using it on your system:

macOS / Linux:

# Show what process is listening on port 2996
lsof -i :2996

# Or with ss (Linux)
ss -tlnp | grep 2996

Windows:

# Show listening ports and associated processes
netstat -ano | findstr :2996

# Then look up the PID
tasklist /fi "PID eq <PID>"

If nothing appears, nothing is listening. That's the normal state for this port.

Why Assigned-but-Dormant Ports Matter

The registered port space has around 48,000 numbers in it. Many are actively used. Many more are registered to protocols that shipped and thrived. But a meaningful fraction look like port 2996: claimed, dormant, and taking up space in the registry.

This creates a practical problem. When developers pick a port for a new application, they're supposed to check the IANA registry and avoid conflicts. Port 2996 is technically taken — but using it won't break anything, because vsixml isn't running anywhere. The registry's accuracy depends on registrants keeping their entries current, which they often don't.

It's one of the reasons the ephemeral port range (49152–65535) exists: a space where applications can grab a temporary port without worrying about registry conflicts, because no one owns those numbers.