Port 2139: IAS-Auth — A Reserved Port for a Retired Service

Port 2139 sits in an unusual position: officially registered, but effectively abandoned.

IANA assigned this port to IAS-AUTH — the authentication component of Microsoft's Internet Authentication Service (IAS). IAS was Microsoft's implementation of a RADIUS server, handling authentication, authorization, and accounting for dial-up and VPN connections during the Windows 2000 and Windows Server 2003 era.

When Windows Server 2008 shipped, Microsoft replaced IAS with Network Policy Server (NPS). The new name reflected a broader scope — NPS handled modern wireless 802.1X authentication and more granular network access policies, not just the dial-up scenarios IAS was built for.

IAS is gone. Port 2139's registration remains.

What Range This Port Belongs To

Port 2139 is a registered port (range: 1024–49151).

Registered ports are assigned by IANA to specific services that request them. They aren't reserved for system use like well-known ports (0–1023), but they carry an official claim. The intention is to prevent collisions: if your application squats on port 2139, you're technically competing with an IANA registration, even if that registered service hasn't been deployed in twenty years.

The IAS-AUTH Background

IAS appeared in Windows NT 4.0 and was the standard way Windows shops handled centralized authentication for remote access servers. It spoke RADIUS — the protocol that lets network devices offload authentication decisions to a central server.

RADIUS itself standardized on ports 1812 (authentication) and 1813 (accounting). ¹ IAS also used 1645 and 1646, legacy RADIUS ports that predate the official standard. Port 2139 appears to have been a separate IAS registration, though Microsoft's current documentation doesn't explain what distinguished IAS-AUTH from standard RADIUS authentication.

With Windows Server 2008, Microsoft officially deprecated IAS and shipped NPS as its successor. ² NPS uses the standard RADIUS ports. Port 2139 stopped appearing in any active Microsoft deployment guidance.

Unofficial Uses

No commonly observed unofficial uses. Port scanners and security researchers don't flag it as a vector for known malware families. If something is listening here on a machine not running ancient Windows Server software, it warrants investigation — not because port 2139 is inherently suspicious, but because unexpected listeners always do.

How to Check What's Listening

Linux/macOS:

sudo ss -tlnp | grep 2139
# or
sudo lsof -i :2139

Windows:

netstat -ano | findstr :2139

The PID returned lets you trace back to the process in Task Manager or with tasklist /fi "PID eq <pid>".

Why Unassigned-but-Registered Ports Matter

The registered port range is 48,128 ports wide. Keeping it coherent requires that registrations mean something — and that means dead registrations create real problems. If two applications both decide port 2139 is available because its registered service is gone, they conflict in environments where both happen to be deployed.

IANA doesn't actively reclaim abandoned registrations. Port 2139 will remain officially "IAS-AUTH" on the books unless someone formally requests its reassignment. The port is a minor bureaucratic artifact from a service most systems forgot existed.