Port 1754: oracle-em2 — Oracle's Intelligent Agent, Retired in Place

What Port 1754 Is

Port 1754 is registered with IANA under the service name oracle-em2. It was the RPC (Remote Procedure Call) handler for Oracle's Intelligent Agent, a daemon that ran on database servers so the Oracle Enterprise Manager console could reach in and monitor them.¹

The Intelligent Agent actually used two ports. Port 1748 handled SNMP communication between internal components. Port 1754 was the outward-facing RPC endpoint — the one Enterprise Manager actually talked to when it wanted to check on a database.²

A Bit of History

Oracle's Intelligent Agent dates to the early days of Oracle Enterprise Manager, when managing databases meant deploying a small agent process on every server you cared about. That agent ran as dbsnmp — a name that still appears in Oracle databases today, though its role has changed considerably.³

In Oracle 10g, the Intelligent Agent was replaced by a new agent architecture (emagent). Oracle Enterprise Manager 12c and 13c use an entirely different port structure. Port 1754 was left behind — still registered with IANA, still technically named, but rarely deployed in anything built in the last fifteen years.⁴

The Registered Ports Range

Port 1754 sits in the registered ports range (1024–49151). This range sits between the well-known ports (0–1023), which require root or administrator privileges to bind, and the ephemeral ports (49152–65535), which operating systems hand out dynamically for outgoing connections.

Registered ports don't require elevated privileges to bind. IANA maintains their assignments as a coordination service — to prevent two applications from unknowingly colliding on the same number. The registration doesn't confer any enforcement; software can use port 1754 for anything.

If You See Port 1754 Open

If you find port 1754 listening on a server, you're probably looking at an older Oracle database installation with the legacy Intelligent Agent still running. That's worth noting for two reasons:

1. Age signal. Intelligent Agent installations are typically Oracle 9i-era or earlier. Databases that old are likely running on unsupported versions.
2. Attack surface. The Oracle Intelligent Agent has a documented history of security vulnerabilities. A system still running it deserves scrutiny.⁵

To check what's listening:

# Linux/macOS
sudo ss -tlnp | grep 1754
sudo lsof -i :1754

# Windows
netstat -ano | findstr :1754