Port 2311: Unassigned — Reserved but Unclaimed

What Port 2311 Is

Port 2311 has no assigned service. The Internet Assigned Numbers Authority (IANA) — the body that manages port numbers — lists it as unassigned in the registered port range.

That means no protocol owns it. No RFC defines it. No standard software expects to find anything there.

The Registered Port Range

Port 2311 sits in the registered ports range (1024–49151). This range was designed for applications that need a consistent, findable port — not the chaos of ephemeral ports, but not the well-known territory of ports below 1024 either.

The theory: vendors apply to IANA, get a number, and that number becomes associated with their service. In practice, thousands of numbers in this range were never claimed, or were claimed and then abandoned as the software died. Port 2311 is one of them.

The Studio54 Connection

Port 2311 has been flagged in security databases as a communication channel for Studio54, a trojan.¹ The name is presumably a reference to the famous New York nightclub, which suggests someone had a sense of humor about their malware.

This doesn't mean anything listening on port 2311 is malicious. The trojan is old, and any port can be used by any software. But it does mean this port has a history worth noting: legitimate software hasn't staked a claim here, and malware has.

What to Do If You See Activity Here

If you find something listening on port 2311 and don't recognize it, check what it is:

On Linux/macOS:

# See what process owns port 2311
sudo lsof -i :2311

# Or with ss
sudo ss -tlnp | grep 2311

On Windows:

# Show process using port 2311
netstat -ano | findstr :2311

# Then look up the PID
tasklist | findstr <PID>

An unrecognized process on an unassigned port is worth investigating. It's probably nothing — custom internal tools, development servers, and legacy applications often land on unassigned ports. But it's the right question to ask.

Why Unassigned Ports Exist

The registered port space has 48,128 numbers. Not all of them are spoken for, and that's fine. The system was designed with room to grow. IANA assigns numbers on request, and plenty of requests never came.

Unassigned ports serve a quiet purpose: they document the gaps. When you see "unassigned" next to a port number, it tells you something real — no standard protocol is supposed to be there. Anything running on that port is either custom software or something that never got formalized. That's useful to know.