Port 2828: Registered, Mostly Unclaimed — Except by Firefox

Port 2828 is a registered port. IANA assigned it to something called ITM License Manager (itm-lm), an enterprise software licensing service that has left almost no trace on the public Internet. In practice, port 2828 is known for something else entirely.

The Registered Range

Ports 1024 through 49151 are the registered ports. Unlike well-known ports (0–1023), which require root privileges on Unix systems and carry protocols the whole Internet depends on, registered ports are territory that vendors and developers can claim for their applications by submitting a request to IANA.

Registration doesn't mean enforcement. Nobody checks. A registered port is just a handshake agreement — "we'd like to use this number, please note it down." Another application can use the same port on your machine tomorrow, and nothing stops it. The registry exists to reduce collisions, not eliminate them.

Port 2828's official occupant — ITM License Manager — registered the port and then largely disappeared from view. Port databases list it. Nobody talks about it.

Firefox Marionette: The Actual Tenant

In practice, port 2828 belongs to Mozilla Marionette, Firefox's built-in remote control protocol.

Marionette is how automated tests talk to Firefox. When Selenium, WebDriver, or any browser automation framework needs to tell Firefox to click a button, navigate to a URL, or evaluate JavaScript, it connects to a Marionette server. That server listens, by default, on port 2828.¹

When you run Firefox with the --marionette flag, it opens a TCP socket on 2828 and waits. The test client connects, sends JSON commands, and Firefox responds. Every end-to-end test that runs against a real Firefox browser — in CI pipelines, in QA environments, in automated regression suites — quietly uses this port.²

Why 2828 specifically? The Firefox source code just says it's the default. The historical reasoning, if there was deliberate reasoning at all, didn't make it into public documentation. The number was chosen, it stuck, and now it's baked into tooling across the ecosystem.³

Checking What's on This Port

If port 2828 is open on a system you're investigating, the most likely explanation is a Firefox instance running in automation mode. Other possibilities:

# See what process is listening on 2828
sudo lsof -i :2828

# Or with ss (Linux)
ss -tlnp sport = :2828

# Or with netstat
netstat -an | grep 2828

On a developer machine, you might see this appear and disappear as automated tests run. On a server, it's worth understanding why Firefox is running at all.

Why Unassigned Ports Matter

The registered port range has roughly 48,000 slots. Most are empty. This gap between "officially assigned" and "actually used" is how the Internet works in practice — protocols and applications stake out territory informally, through convention and widespread adoption, more than through any central authority.

Port 2828 is a small example of this: IANA assigned it to one thing, the broader ecosystem adopted it for something else, and the two coexist because there's no mechanism to resolve the conflict. On any given machine, only one service can actually bind to the port. The registry just keeps the original reservation on file, gathering dust.