Port 2589: Quartus TCL — Registered but Rarely Seen

What This Port Is

Port 2589 sits in the registered port range (1024–49151). IANA formally assigned it to quartus-tcl on both TCP and UDP — the Tcl scripting interface used by Intel Quartus Prime, the software suite engineers use to design and program FPGAs (field-programmable gate arrays).

Quartus is serious professional software. If you're building custom chips for aerospace or industrial controllers, you may well have encountered it. But its TCL interface communicating over port 2589 is not common outside of dedicated EDA (Electronic Design Automation) workstations. You will not see this port on a typical web server, database host, or cloud VM.

The Squatter Problem

Port 2589 has a shadow. The Dagger trojan — a remote access tool from the early 2000s — used this port as its command-and-control channel. It was obscure enough as malware, but persistent enough that security databases still list it first when you look up 2589.

The result: this port triggers alerts at many firewalls and IDS systems not because Quartus is suspicious, but because Dagger got here first and left a mark.

If you see port 2589 open on a machine that isn't running Quartus design software, that is worth investigating.

How to Check What's Listening

Linux / macOS:

# Show what process is listening on port 2589
sudo ss -tlnp | grep 2589
# or
sudo lsof -i :2589

Windows:

netstat -aon | findstr :2589

The output will include the process ID (PID). Cross-reference it with Task Manager or tasklist to identify the process.

Why Unassigned and Rarely-Used Ports Still Matter

The registered port range contains over 48,000 ports. Most of them sit idle. But "idle" doesn't mean "safe" — unmonitored open ports are exactly what scanners probe for. The SANS Internet Storm Center records ongoing scanning activity against port 2589, as automated tools sweep the address space looking for anything that answers.

A port being registered doesn't mean it's running on your system. It means someone asked IANA to associate a name with a number, and IANA said yes. What actually runs on any given port is entirely up to whoever controls the machine.