Port 2412: Unassigned — A Registered Port With No Tenant

What Range This Port Belongs To

Port 2412 falls in the registered port range (1024–49151). This range exists so software developers can formally register a port number with IANA, preventing two applications from accidentally claiming the same number and creating chaos across the Internet.

Port 2412 has not been claimed. IANA's registry lists it as unassigned.¹

That's it. No RFC. No protocol. No history of an application that standardized here and then faded away. Just an empty slot.

Any Known Unofficial Uses

Some older security databases flag port 2412 as having been used by malware for command-and-control communication.² This is worth understanding correctly: it doesn't mean port 2412 is malicious. It means that at some point, malware authors chose an unassigned port — this one — because unassigned ports attract less scrutiny. There's no legitimate service to act as a canary.

No widely-used legitimate software is known to claim 2412 as its home port.

How to Check What's Listening

If you see port 2412 active on your system, here's how to find out what's using it:

On Linux or macOS:

sudo ss -tlnp | grep 2412
# or
sudo lsof -i :2412

On Windows:

netstat -ano | findstr :2412
# Then look up the PID:
tasklist | findstr <PID>

The process name will tell you whether it's something you installed intentionally or something that warrants a closer look.

Why Unassigned Ports Matter

The port numbering system only works because most ports mean something consistent. When you see port 443, you know HTTPS. When you see port 22, you know SSH. That predictability is the foundation of network security — you can build firewall rules, intrusion detection signatures, and monitoring alerts around it.

Unassigned ports break that predictability. They're gaps in the map. Legitimate software occasionally uses them temporarily (see: ephemeral ports), but persistent listeners on unassigned registered ports are worth investigating. The registered range exists for declared, stable services. Squatters — whether applications or malware — should raise a question.