Port 2193: DRWCS — The Antivirus Command Line

Port 2193 sits in the registered ports range (1024–49151), which means any software vendor can apply to IANA to claim it. Most ports in this range carry traffic you'd recognize. Port 2193 carries traffic from a company most people outside of Eastern Europe have never heard of.

What It Does

Port 2193 is registered to DRWCS — the Dr.Web Central Server, the management hub for Dr.Web Enterprise Security Suite.¹ In enterprise deployments of Dr.Web antivirus, a central server coordinates thousands of endpoint agents across an organization's network. Port 2193 is the channel those agents use to receive configuration, policy updates, and commands from the server.²

The protocol is called DWCP — Dr.Web Control Protocol. It's proprietary, not publicly documented in an RFC, and exists solely to let Dr.Web's infrastructure talk to itself.

Who Uses This Port

Dr.Web is one of the oldest antivirus companies in the world, founded in Russia in 1992.³ It's widely deployed in Russian government agencies, Eastern European enterprises, and telecommunications companies. If you see unexpected traffic on port 2193, Dr.Web's management service is the most likely explanation — though any application can use any unblocked port.

If you don't run Dr.Web Enterprise Suite and you're seeing port 2193 active on a machine, that's worth investigating.

What the Registered Port Range Means

The registered port range runs from 1024 to 49151. These ports don't require root or administrator privileges to bind (unlike the well-known ports below 1024). IANA maintains the registry, but registration is voluntary — applications can use any port not already claimed, and plenty do without ever filing with IANA.

Port 2193 made it into the registry. That means Dr.Web filed the paperwork, and now the port officially belongs to them on paper.

How to Check What's Listening on This Port

On Linux or macOS:

# Show which process is listening on port 2193
ss -tlnp | grep 2193

# Or with lsof
lsof -i :2193

On Windows:

netstat -ano | findstr :2193

Take the process ID from the output and look it up in Task Manager or with tasklist /fi "PID eq <pid>". That tells you what program opened the port.