Port 2636: Solve — A Registered Port with No Known Purpose

What This Port Is

Port 2636 sits in the registered ports range (1024–49151). These are ports that applications and services can request from IANA for official assignment, distinguishing their traffic from the chaos of ephemeral connections. Unlike the well-known ports below 1024—which require root privileges and carry protocols the entire Internet depends on—registered ports are claimed on a first-come, first-served basis by anyone with a service to name.

Port 2636 is registered. IANA lists it as "Solve," attributed to a contact named Peter Morrison, assigned on both TCP and UDP.¹

That is the entirety of the public record.

The Ghost in the Registry

No RFC documents the Solve protocol. No open-source implementation exists. No security advisory references it. No packet capture analysis has ever turned up traffic that identifies itself as Solve. Whatever Peter Morrison intended to build—or did build—left no trace in the public record.

This isn't unusual. The registered ports range contains thousands of entries like this: a name, a number, a contact who may no longer exist, and nothing else. Port numbers were cheap to register and easy to abandon. The registry faithfully preserves these ghosts.

"Solve" joins a long list of registered ports whose purpose is now a minor historical mystery.

What You Might Find Here Instead

Because port 2636 carries no recognizable service, anything listening on it is either:

• Custom software — internal tools, proprietary protocols, or developer test servers that needed a port and picked this one
• Malware — attackers sometimes bind to obscure registered ports precisely because they generate no alerts
• Misconfiguration — a service meant to run elsewhere that ended up here

If you see unexpected traffic on port 2636, treat it as unknown until you can identify the process behind it.

How to Check What Is Listening

On Linux or macOS:

# Show the process using port 2636
sudo ss -tlnp sport = :2636

# Alternative using lsof
sudo lsof -i :2636

On Windows:

netstat -ano | findstr :2636

The PID in the last column can be matched to a process in Task Manager or with:

tasklist /fi "pid eq <PID>"

If something is listening and you don't recognize it, that's worth investigating.

Why Unassigned (and Forgotten) Ports Matter

The registered ports range exists to reduce collisions—to give services predictable addresses that other traffic won't accidentally occupy. When a port is registered but never documented, it fails at that job. Nothing knows to avoid it. Nothing knows what to expect from it.

The practical effect: port 2636 is effectively unclaimed territory. Any software can use it, and does. The IANA entry for "Solve" provides no protection, no context, and no interoperability guarantee. It is a number with a name and nothing more.