Port 2827: I2P BOB — The anonymous network's forgotten bridge

What Is Port 2827?

Port 2827 sits in the registered port range (1024–49151), meaning IANA accepted an application for it and assigned it an official service name: slc-ctrlrloops. The description in the registry is "slc ctrlrloops." That's the entirety of the public documentation. Nobody seems to know what SLC Controller Loops is, who uses it, or whether it ever shipped.

What port 2827 is actually known for is something more interesting.

I2P's Basic Open Bridge (BOB)

I2P — the Invisible Internet Project — is an anonymous overlay network. Unlike Tor, which focuses on reaching the public Internet anonymously, I2P is designed primarily for communication within its own encrypted network, where addresses end in .i2p and routing happens through a volunteer-operated mesh of roughly 55,000 nodes worldwide.

To let external TCP applications tunnel through I2P, the project built a series of APIs. One of them was BOB — the Basic Open Bridge.

BOB listened on 127.0.0.1:2827. A local application would open a TCP connection to that port, issue plain-text commands (you could do it with telnet), and instruct the I2P router to create, configure, and manage tunnels into the anonymous network. It was a control channel — not for data, but for telling the router what to do.¹

The protocol was intentionally simple. You connected, typed commands, and the router responded. No XML, no JSON, no handshake ceremony. Just a text protocol over a local socket, designed for developers who found I2P's other APIs too complex.

BOB Is Now Deprecated

BOB was removed from new Java I2P installations in release 1.7.0, shipped in February 2022.¹ Installations originally set up on version 1.6.1 or earlier still have it, but new installs don't.

The preferred replacement is SAMv3 (Simple Anonymous Messaging, version 3), which handles the same use case with a more capable protocol.²

BOB is still supported by i2pd, the C++ I2P router implementation, as of 2025.³ So the port is genuinely quiet on most machines but occasionally still active on systems running older I2P configurations or i2pd with BOB enabled.

Who Actually Saw This Port

Port 2827 was strictly localhost — bound to 127.0.0.1, not exposed to the network. If you saw it open in a port scan of a remote host, something was misconfigured or deliberately exposed.

On a local machine, it would appear if you ran Java I2P before version 1.7.0, or i2pd with BOB enabled in the configuration.

Checking What's Listening

To see if anything is using port 2827 on your system:

macOS / Linux:

lsof -i :2827

or

ss -tlnp | grep 2827

Windows:

netstat -ano | findstr :2827

If you see java bound to 127.0.0.1:2827, that's an older I2P installation. If you see nothing, the port is quiet.

Why Unassigned (or Obscurely Assigned) Ports Matter

The registered port range contains thousands of entries like slc-ctrlrloops — names that received an IANA assignment and then vanished. This isn't a failure of the system. IANA's job is to prevent collisions, not to curate living software. A port can be registered and abandoned, and the number keeps its claim on the namespace indefinitely.

The consequence: when software needs a well-known local port and picks something from this range, it's navigating a landscape of ghost claims and squatters. I2P chose 2827 for BOB despite the slc-ctrlrloops registration. That's common practice — informal use often diverges from the registry, especially for localhost-only services where collision risk is low.