Port 2433: Coda's Secure Server — and SQL Server in Disguise

What Port 2433 Is

Port 2433 sits in the registered ports range (1024–49151). These ports are assigned by IANA to specific services, but the assignments aren't enforced — any application can use any port, so what you actually find on 2433 depends on what's running on the machine.

IANA's official assignment: codasrv-se — the secure variant of the Coda distributed filesystem server.¹

The Official Tenant: Coda Filesystem

Coda is a distributed filesystem developed at Carnegie Mellon University starting in 1987, descending from the Andrew File System (AFS). Its server daemon is codasrv. Port 2432 carries the base server; port 2433 carries codasrv-se, the secure edition.

Coda was a significant research achievement — it handled network partitions and disconnected operation in ways that AFS couldn't. But it remained primarily an academic system. Today, finding active Coda traffic on port 2433 in the wild is rare.

The Unofficial Tenant: SQL Server Hidden Mode

The port most people associate with 2433 is Microsoft SQL Server running in hidden mode.

SQL Server's default port is 1433. When administrators configure SQL Server to hide itself from the SQL Server Browser service, the Client Network Utility historically set the port to 2433 — exactly 1,000 above the default.² The logic is unclear; the port just became the convention. Some backup software (including older versions of Symantec Backup Exec) communicated with SQL Server on this port for exactly this reason.

The "hidden" label is generous. Port 2433 is as easy to discover as 1433. A basic port scan finds it immediately. What hiding actually does is suppress SQL Server's broadcast announcements to the network — it stops advertising itself, but it still answers when called directly.

If you find SQL Server traffic on 2433, you're looking at a server whose administrator wanted to reduce its visibility profile, not make it invisible.

How to Check What's on Port 2433

On Linux/macOS:

# See what's listening locally
ss -tlnp | grep 2433
# or
lsof -i :2433

On Windows:

netstat -ano | findstr :2433

From another machine (basic scan):

nmap -sV -p 2433 <target>

If you get a response that looks like a TDS (Tabular Data Stream) handshake, it's SQL Server. If you get silence, nothing is listening — or a firewall is dropping the probe.

Why Unassigned Gaps Matter

The registered range has 48,128 ports. IANA has assigned roughly a few thousand of them. The rest exist as potential space — available for applications that need a consistent, findable home without going through formal registration. Port 2433 is one of the assigned ones, but its official tenant (Coda) vacated in practice, leaving the port to be squatted by SQL Server's hidden mode convention.

This is the normal life of a registered port: officially spoken for, practically available, actually used for something else entirely.