Port 2973: svnetworks — A Ghost in the Registry

What Port 2973 Is

Port 2973 sits in the registered port range (1024–49151). These ports are not controlled by the operating system the way well-known ports (0–1023) are — any user process can bind to them without elevated privileges. IANA maintains a registry of registered ports to prevent collisions between services, though registration doesn't guarantee a service actually exists or is widely deployed.

IANA lists port 2973 as assigned to svnetworks, registered by SV Networks. The contact on file is Sylvia Siu (ssiu@svnetworks.com). That's where the paper trail ends.¹

No RFC. No protocol specification. No public documentation. No evidence of software that ever shipped using this port. The registration exists; the service, apparently, does not.

Ghost Registrations

This is more common than you'd expect. The IANA registry contains thousands of registered ports, and a meaningful number of them are what security researchers call ghost registrations — ports claimed by organizations that either never shipped the software, dissolved before the service matured, or registered speculatively.

Ghost registrations aren't inherently harmful. They occupy space in a namespace that has more than 48,000 registered slots, so the cost is low. But they create confusion: is something running on port 2973 legitimate or not? The registry can't tell you.

What Might Actually Be Listening

If you see traffic on port 2973, it is almost certainly not SV Networks. Possible explanations:

• Custom application: Internal tooling that happened to pick this port
• Malware or RAT: Obscure ports with ghost registrations are occasionally chosen by attackers precisely because they look registered but aren't scrutinized
• Ephemeral connection: Outbound connections from your machine use random high ports, and 2973 might appear as a source port briefly

How to Check What's Listening

On any Unix-like system:

# Show what process is listening on TCP port 2973
sudo lsof -i TCP:2973

# Or with ss (faster on Linux)
sudo ss -tlnp sport = :2973

# On Windows
netstat -ano | findstr :2973

If something is listening, the process name and PID will tell you more than the port number ever could.