Port 2079: IDWARE Router Port — A Label Without a Story

Port 2079 is a registered port — meaning it falls in the 1024–49151 range that IANA maintains for applications and services that have formally requested a number.¹ IANA lists it as "IDWARE Router Port" with the service name idware-router, assigned for both TCP and UDP.

What IDWARE was or is remains unclear. The name appears in the registry and then nowhere else of consequence — no RFC, no public documentation, no active community. It's a ghost registration: someone filed the paperwork, got the number, and then left no further trail.

What the Registered Range Means

The registered range (ports 1024–49151) is not like the well-known range below 1024. Well-known ports — HTTP at 80, HTTPS at 443, SSH at 22 — are stable, globally recognized assignments with decades of infrastructure built around them. The registered range is more like a parking lot. IANA records who claimed a spot, but there's no enforcement, no guarantee the claimant is still operating, and no requirement that anyone actually use the number.

Port 2079 is one of thousands of registered ports that exist as entries in a spreadsheet more than as living services on the network.

A Secondary Overlap: IRLP

Port 2079 also falls inside the UDP range used by IRLP — the Internet Radio Linking Project, which connects amateur (ham) radio stations to each other over the Internet using Voice over IP.² IRLP uses UDP ports 2074 through 2093 for bidirectional audio between nodes.³

So on a machine running IRLP, port 2079 UDP may well be in use — just not for IDWARE, whatever that was.

Scanning Activity

SANS Internet Storm Center shows occasional scanning activity on port 2079, consistent with automated probes that sweep the registered port range looking for open services.⁴ Threat level is low. This is background noise, not targeted exploitation.

How to Check What's Using This Port

If you see port 2079 active on your system and want to know why:

macOS / Linux:

lsof -i :2079

Linux (alternative):

ss -tulnp | grep 2079

Windows:

netstat -ano | findstr :2079

The output will show which process ID owns the socket. From there, you can identify the application.