Port 2970: INDEX-NET — Registered, Forgotten

What This Port Is

Port 2970 belongs to the registered ports range — numbers from 1024 to 49151 that organizations can formally claim with IANA, the Internet Assigned Numbers Authority. Unlike well-known ports (0–1023), registered ports don't require special OS privileges to use. Unlike ephemeral ports (49152–65535), they're meant to be stable, named, and associated with a specific service.

Port 2970 is registered. Its service name: INDEX-NET. Its registrant: Chris J. Wren at Lucent Technologies.

That's where the trail ends.

The INDEX-NET Mystery

Lucent Technologies was spun out of AT&T's Bell Labs in 1996 and for a few years was one of the most valuable technology companies on Earth. Bell Labs had invented the transistor, Unix, and C. Lucent carried that legacy — and registered dozens of ports with IANA for internal services and products during the late 1990s.

INDEX-NET was one of them. It was registered for both TCP and UDP on port 2970. But unlike most protocols, no RFC was written for it. No technical documentation surfaced publicly. When Lucent imploded after the dot-com bust and was eventually absorbed into Nokia and other acquirers, INDEX-NET went with it — leaving only a name in a registry.

This isn't unusual. The IANA registry is full of ports registered by companies that no longer exist, for services that were never fully deployed, or for internal tools that never needed public documentation. INDEX-NET appears to be all three.

What's Actually on Port 2970

In practice: probably nothing. No major application claims this port. Security scanners don't flag it as a known attack surface. It doesn't appear in common network monitoring signatures.

If you're seeing traffic on port 2970, it's worth investigating — but the cause is almost certainly application-specific, not the INDEX-NET service IANA lists.

How to Check What's Listening

On Linux or macOS:

# Show what process is listening on port 2970
ss -tlnp | grep 2970
# or
lsof -i :2970

On Windows:

# Show listening port with process ID
netstat -ano | findstr :2970

# Map PID to process name
Get-Process -Id <PID>

Using nmap to check a remote host:

nmap -p 2970 <target>

Why Unassigned (and Forgotten) Ports Matter

The port system works because services claim numbers and stick to them. When a port is registered but unused, it creates a small ambiguity: if your firewall sees traffic on 2970, is it INDEX-NET? Something else? Malware using an obscure registered port to blend in?

The answer is almost always "something else" — custom applications, development servers, game servers, and misconfigured software all end up on registered-but-quiet ports like 2970. The IANA name gives you a clue to check against, but the process audit (lsof, ss, netstat) tells you the truth.