What Port 2787 Is
Port 2787 sits in the registered ports range (1024–49151) — the middle tier of the port numbering system, between the privileged well-known ports below 1024 and the ephemeral ports above 49151.
According to the IANA Service Name and Transport Protocol Port Number Registry, port 2787 is assigned to a service called "piccolo", attributed to Cornerstone Software, on both TCP and UDP.1 That's where the paper trail ends.
No RFC defines the piccolo protocol. No public documentation describes what it does. No active community uses it. The registration exists; the protocol, for all practical purposes, does not.
What "Registered" Actually Means
Registration in the IANA registry isn't certification of a living, maintained protocol. It means someone, at some point, filed a request and received an assignment. Many registered ports belong to software that was abandoned, never shipped, or existed only in a single organization's internal systems.
Port 2787 appears to be one of those. "Piccolo" by "Cornerstone Software" is not a product anyone can find documentation for today. The port number was claimed; the protocol behind it left no public fingerprint.
Is Anything Else Using It?
Ports in the 2700–2800 range have occasionally been associated with KnowShowGo P2P traffic in informal port databases.2 Port 2787 itself has no widely observed association with any specific application or malware family.
If you're seeing traffic on port 2787, it's more likely to be:
- A custom or internal application that chose this port arbitrarily
- Misconfigured software looking for something else
- A port scanner probing your system
- An ephemeral connection assigned temporarily by the OS (though this range is technically registered, not ephemeral)
How to Check What's Using It
If port 2787 is active on your system, these commands will tell you what's listening:
macOS / Linux:
Linux (alternative):
Windows:
The output will show the process ID (PID) and name of whatever has claimed the port.
Why Ports Like This Matter
The registered ports range contains thousands of entries like port 2787 — names attached to protocols that never achieved public adoption. This is normal and expected. Not every registered service becomes infrastructure. Most don't.
What matters is that the range exists, that IANA tracks it, and that the system as a whole prevents two well-intentioned services from accidentally colliding on the same number. Port 2787 may be quiet, but its registration still serves a function: it marks this number as taken, and tells any new service looking for a home to look elsewhere.
The Internet's port system is partly a living directory and partly a museum of protocols that didn't make it.
האם דף זה היה מועיל?