Port 2653: Sonus — A Registered Ghost

What Port 2653 Is

Port 2653 sits in the registered port range (1024–49151), also called user ports. This range is administered by IANA, the organization that assigns meaning to port numbers so that software knows where to knock and what to expect at the door.

Within this range, developers and companies can register a port for their application. IANA records the service name, the contact, and the protocol. The registry does not verify that the software actually ships, scales, or survives.

Port 2653 is registered as "sonus" — assigned to a contact named Mark Garti. That's the entirety of the paper trail. No RFC. No documentation. No known software in active use that listens on this port. ¹

The Registered-but-Empty Problem

The registered port range has thousands of entries like this. A developer or company claims a port in anticipation of a product. The product doesn't ship, gets renamed, pivots, or quietly dies. The port number stays claimed indefinitely — IANA doesn't reclaim registrations.

This matters for a few reasons:

• Security tools may flag it. Port scanners and firewall rules that block "suspicious" registered ports sometimes catch traffic on 2653, not because the protocol is dangerous, but because nothing legitimate is expected there.
• Malware occasionally squats here. When a port has no known legitimate use, it makes reasonable cover for software that wants to blend into ambiguity. This is opportunistic, not specific to 2653.
• It's not blocked by default. Unlike well-known ports (0–1023), registered ports require no privilege to bind on most operating systems. Any process can listen on 2653 without root access.

If Something Is Listening on Port 2653

Something listening on 2653 on your machine is not "sonus" — it's whatever process decided to use an available port. To find out what that is:

On Linux/macOS:

# Show what's listening on port 2653
ss -tlnp | grep 2653

# Or with lsof
lsof -i :2653

On Windows:

# Show listening processes with port info
netstat -ano | findstr :2653

# Then look up the PID
Get-Process -Id <PID>

The output will show you the process name and ID. From there you can identify whether it's something you installed, something system-level, or something that shouldn't be there.