Port 2099: H.225.0 Annex G — A telecom relic, mostly empty

What Port 2099 Is

Port 2099 is a registered port — in the range 1024–49151, where IANA assigns numbers to specific services but doesn't enforce exclusivity the way it does for well-known ports below 1024.

IANA's official assignment: H.225.0 Annex G Signalling, service name h2250-annex-g. Both TCP and UDP.¹

The Official Tenant: H.225.0 Annex G

H.225.0 is part of the H.323 protocol suite — the ITU's attempt in the late 1990s to standardize voice and video calls over IP networks. H.323 was the dominant VoIP standard before SIP took over, and it handled everything from call setup to billing negotiation between different carriers.

Annex G specifically dealt with communication between administrative domains — two different organizations' H.323 networks negotiating how to complete a call across their boundary.² Port 2099 was assigned for that inter-domain signaling.

H.323 Annex G never saw the adoption its designers hoped for. SIP arrived, the industry moved on, and port 2099 was left holding a number for a protocol most networks never ran.

Who Actually Uses It

Since the official tenant barely showed up, others moved in:

League of Legends used port 2099 for PVP.Net client connections — the background service that handles friends lists, chat, and matchmaking. Players troubleshooting connectivity issues would find guides telling them to open port 2099 in their firewall.³

CA ARCserve Backup (Broadcom) uses port 2099 as part of its data mover configuration, alongside ports 7099 and the 20000–20100 range.⁴

WebMethods OneData (Software AG) runs a Java RMI registry on port 2099 by default. In 2023 this became a security concern — CVE-2023-0925 documented that an unauthenticated attacker with network access could exploit the RMI registry to load a malicious serialized Java object, achieving remote code execution.⁵

Cisco Unified CVP uses port 2099 for JMX communication between the Operations Console and the CVP Resource Manager.⁶

Checking What's Listening on Port 2099

If you see traffic on this port and want to know what's using it:

Linux / macOS:

# Show process listening on port 2099
ss -tlnp sport = :2099

# Or with lsof
lsof -i :2099

Windows:

netstat -ano | findstr :2099

Then match the PID to a process name in Task Manager, or:

tasklist /fi "PID eq <pid>"

Why Unassigned-in-Practice Ports Matter

The registered port range contains thousands of ports like 2099 — officially assigned to something, but that something never became widely deployed. These ports are neither truly free nor truly occupied.

Software vendors pick them knowing they're unlikely to conflict with anything real. That's practical, but it creates a patchwork: the same port number can mean different things on different systems, and a firewall rule written for one application might silently affect another.

If port 2099 shows up in your logs unexpectedly, it's worth checking. It's not inherently suspicious — but the legitimate uses are specific enough that unknown traffic there deserves a second look.