Port 2798: TMESIS-UPShot — A Ghost in the Registry

What Range This Port Belongs To

Port 2798 falls in the registered ports range (1024–49151). These ports aren't reserved by the operating system the way well-known ports (0–1023) are — any process can bind to them without special privileges. But IANA maintains a registry of assignments in this range, so organizations can stake a claim to a port number for their software.

Registration in this range is a formality. It prevents two companies from officially claiming the same number. It doesn't mean the software is widely used, still maintained, or running on any machine you'll ever encounter.

The Official Assignment: TMESIS UPShot

Port 2798 (TCP and UDP) is registered to TMESIS UPShot, a product from TMESIS Software.¹

TMESIS Software was founded in 1989 to build specialized tools for the OpenVMS operating system — the software that ran on Digital Equipment Corporation's VAX and Alpha computer platforms.² Their products focused on application development and system management for that ecosystem.

UPShot was one of their applications. The details of what it did are now difficult to reconstruct: TMESIS's website is unreachable, their documentation is gone, and the OpenVMS ecosystem it was built for has contracted dramatically. The port registration remains in the IANA registry as a kind of fossil — proof that the software existed, even if the software itself has vanished.

This is not unusual. The registered ports range contains hundreds of assignments like this: claimed by companies that dissolved, products that were discontinued, or protocols that never shipped. The registry preserves the assignment indefinitely.

Is Anything Actually Using This Port?

Almost certainly not TMESIS UPShot. In practice, port 2798 is unused on the vast majority of systems.

If you see activity on port 2798, it's worth investigating. The most common explanations:

• Custom or internal software that chose this port arbitrarily
• Ephemeral connections — outbound connections from your system use temporary ports, sometimes in the registered range
• Misconfigured or mislabeled service

How to Check What's Listening

macOS / Linux:

# Show all listening ports with the process using them
sudo lsof -i :2798

# Or with netstat
sudo netstat -tlnp | grep 2798

Windows:

netstat -aon | findstr :2798

The output will show the process ID (PID). Cross-reference with Task Manager or ps aux to identify the process.

Why Ghost Assignments Matter

The registered ports range has room for over 48,000 port numbers. It sounds like plenty — and it was, until decades of software registrations accumulated. Today the registry has thousands of entries for products that no longer exist.

These ghost assignments create a subtle problem: they crowd out the range, make port lookup tables harder to parse, and create false confidence. When a security tool flags port 2798 as "TMESIS-UPShot," it sounds authoritative — but that label tells you almost nothing about what's actually running. The real question is always what your system has bound to that port, not what a registry entry from the 1990s claims it should be.