Port 2995: IDRS — The Ghost Registration

What Port 2995 Is

Port 2995 sits in the registered port range (1024–49151). These ports are assigned by IANA to specific services and applications — not reserved for operating systems like the well-known ports below 1024, but formally claimed by whoever asked first.

Port 2995 was formally claimed. IANA lists it as assigned to "IDRS" on both TCP and UDP, with one Jeff Eaton as the registered contact.¹

That is nearly everything publicly known about it.

The IDRS Mystery

Secondary port databases expand the acronym to "Integrated Distributed Relay Service," but this name appears nowhere in an RFC, nowhere in public documentation, and nowhere in any open-source codebase. There is no specification describing what IDRS does, how it works, or what problem it was designed to solve.

This is a ghost registration: a port claimed during the era when reserving a port number was easy, by someone who may have had real plans — or may not have — and who never published the protocol.

It is not the only ghost in the registry. The registered port range contains hundreds of entries like this: names assigned to projects that were abandoned, companies that folded, or protocols that never left internal use.

Is It Used for Anything?

Not officially. Some security databases flag port 2995 as having been used by malware in the past — which is true of almost any port that sits unclaimed in practice. Attackers don't respect registrations; they use whatever ports firewalls leave open. An unoccupied registered port is as usable as any other.

There are no documented, widely-used unofficial applications running on port 2995 in the way that, say, port 8080 is informally HTTP or port 3306 is informally MySQL.

Checking What's on This Port

If you see traffic on port 2995 on your network and want to know what it is, the answer is almost certainly something local to your environment:

On Linux or macOS:

# See what process is listening on port 2995
sudo ss -tlnp | grep 2995
# or
sudo lsof -i :2995

On Windows:

# Find process listening on port 2995
netstat -ano | findstr :2995

The process ID in the output will tell you what's running. If you weren't expecting anything, investigate.

Why Ghost Registrations Matter

The registered port range exists to prevent collisions: if two different applications both decide to use port 2995, they'll conflict on any machine running both. Registration creates coordination.

But ghost registrations create a different problem: they occupy namespace without delivering the coordination benefit. Port 2995 is "taken" in the registry, which means any new application that wants that port has to pick a different one — even though nothing is actually there.

The IANA registry is a historical artifact as much as an authoritative document. Many registered ports reflect the ambitions of 1990s software projects more than they reflect the software running on the Internet today.