Port 2729: TCIM Control — Registered, but Dark

Port 2729 sits in the registered port range with an official-sounding IANA entry — service name tcim-control, description "TCIM Control" — and almost nothing else.¹

What the IANA Entry Says

The IANA Service Name and Transport Protocol Port Number Registry lists port 2729 as assigned to TCIM Control on both TCP and UDP. That's the whole record. No contact, no specification reference, no RFC.

TCIM appears to stand for Tactical Communication Interface Module — a line of programmable military communication hardware from Raytheon that supports multiple protocols for defense applications.² The IANA registration was presumably filed to reserve the port for software that communicates with this hardware. But Raytheon never published a protocol specification, and there is no public documentation of what exchanges happen on this port.

The door is locked, and the key is classified — or just lost.

What Range This Port Belongs To

Port 2729 falls in the registered ports range: 1024–49151.

The logic of port ranges:

• Well-known ports (0–1023) — Assigned to foundational protocols like HTTP (80), SSH (22), DNS (53). Require root or administrator privilege to bind.
• Registered ports (1024–49151) — Assigned by IANA to specific applications and services. No privilege required to bind. This is where most application-layer services live.
• Dynamic/ephemeral ports (49152–65535) — Unregistered. Used temporarily by your OS when you initiate an outbound connection.³

Registered means IANA recorded a name against the number. It does not mean the protocol is documented, actively used, or that you'd ever encounter it on a normal network.

Known Unofficial Uses

Security databases flag port 2729 as one that has been used by malware in the past. This isn't unusual — attackers scan for open ports and bind to whatever is quiet. A port with no well-known legitimate service running on it is invisible noise, which makes it attractive. There's no specific trojan uniquely associated with 2729; it's just part of the long tail of ports that malware has touched at some point.⁴

If you see traffic on port 2729 on a network that doesn't operate Raytheon TCIM hardware, that's worth investigating.

How to Check What's Listening

If port 2729 is open on your system, here's how to find what's using it:

On Linux/macOS:

# Show the process listening on port 2729
sudo ss -tlnp | grep 2729

# Or with lsof
sudo lsof -i :2729

On Windows:

netstat -ano | findstr :2729

Then cross-reference the PID with Task Manager, or:

Get-Process -Id (Get-NetTCPConnection -LocalPort 2729).OwningProcess

If nothing is listening, the port is closed and there's nothing to worry about.

Why Ghost Registrations Exist

The IANA registry contains thousands of entries like this one: a service name, a number, and no living documentation. Some were registered by companies that no longer exist. Some were filed for internal protocols that never needed to be public. Some represent hardware that's long been decommissioned.

They aren't meaningless — the registration prevents collision, keeps the number from being casually reused. But they're reminders that the port registry isn't a library of documentation. It's more like a deed registry. It records who claimed what. It doesn't tell you what was built on the land.