Port 2010: Registered but Unclaimed — A Tombstone and a Beacon

Port 2010 sits in the registered ports range (1024-49151). These ports aren't assigned by default or claimed at the OS level—they're registered with IANA when a company or project formally requests one. Registration is a reservation, not a lock: anyone can use any port on their own systems, but registered ports signal "this is where you'll find this service."

Port 2010's registration belongs to a product that no longer exists.

The Registered Service: Network Flight Recorder

In the 1990s, Marcus Ranum—one of the architects of the modern firewall—founded a company called Network Flight Recorder. NFR built intrusion detection systems built around a concept borrowed from aviation: every network, like every aircraft, should have a black box. Something that records everything, so when the breach happens, you can reconstruct exactly what occurred.

NFR used port 2010 TCP for administrative communication between its console and central monitoring station. The company registered the port with IANA, called the service "pipe server," and moved on.

Network Flight Recorder is now permanently closed. The port registration remains.¹

The Unofficial Use: TeamSpeak 3's Weblist Beacon

The most commonly observed traffic on port 2010 UDP today comes from TeamSpeak 3, the voice chat platform popular with gaming communities.

When a TeamSpeak 3 server wants to appear on the global server list—so players can find it without knowing its IP address—it sends a UDP beacon to weblist.teamspeak.com on port 2010. This is how your server announces itself to the world: a small, regular packet saying "I'm here, I'm alive, add me to the list."

If you run a TeamSpeak 3 server and port 2010 outbound UDP is blocked by your firewall, your server disappears from the global directory. It still works for people who know your address. It just stops being discoverable.²

How to Check What's Using Port 2010 on Your Machine

If you see traffic on port 2010 and want to know what's generating it:

macOS/Linux:

# Show what process is listening or connected on port 2010
lsof -i :2010

# Or with ss (Linux):
ss -tulpn | grep 2010

Windows:

netstat -ano | findstr :2010

The PID in the last column can be matched to a process in Task Manager or with:

tasklist /fi "pid eq <PID>"

Why Unassigned Ports Matter

The registered ports range contains 48,128 port numbers. Most of them look like port 2010—registered once, possibly abandoned, occasionally repurposed informally.

This is fine. Ports aren't scarce the way IP addresses are. An unassigned port doesn't represent waste; it represents flexibility. Applications that need a predictable, non-conflicting port can register one. Applications that don't care can use ephemeral ports that the OS assigns on the fly.

The gaps in the registry are the breathing room that makes the system work.