Port 2887: Aironet DDP — A Reserved Space for Legacy Wi-Fi

What This Port Is

Port 2887 is registered with IANA for Aironet DDP — the Device Discovery Protocol used by Cisco's Aironet line of wireless access points, operating on both TCP and UDP.¹

In practice, this protocol belongs to a previous era of enterprise Wi-Fi. Cisco acquired Aironet Communications in 1999 and folded the product line into its own wireless portfolio. The early Aironet access points used proprietary protocols — including DDP — to discover and coordinate with each other before standardized wireless management protocols like CAPWAP took over.²

Aironet DDP saw minimal adoption outside Cisco's own gear. Today's Cisco wireless infrastructure has moved on entirely. If you encounter traffic on port 2887, it is almost certainly not Aironet DDP.

What Range This Port Belongs To

Port 2887 falls in the registered ports range: 1024–49151.

These ports are registered with IANA, meaning a specific organization or protocol has formally claimed them. But registration does not mean the protocol is in active use — it means someone once filed the paperwork and IANA recorded it. Many registered ports belong to software that is obsolete, discontinued, or simply never widely deployed.

Registered ports occupy the middle ground between well-known ports (0–1023), which carry the foundational protocols of the Internet, and dynamic/ephemeral ports (49152–65535), which are assigned temporarily by the operating system for outgoing connections.

What to Do If You See Traffic Here

If port 2887 is active on your system, check what is listening:

Linux / macOS:

sudo ss -tlnp | grep 2887
sudo lsof -i :2887

Windows:

netstat -ano | findstr :2887

The process ID returned will tell you exactly what application opened the port. Look it up — if it is not something you recognize and installed intentionally, treat it as suspicious.

Why Unassigned Ports Matter

The registered port space is not a perfect map. It is a historical record: some entries are active and essential, others are relics, and a handful were assigned speculatively and never used at all.

This matters because software sometimes uses unregistered ports — and sometimes collides with registered ones. A modern application that picks port 2887 as its default has technically claimed space that Cisco once registered. Conflicts are rare but real. The port registry exists precisely to prevent two things from shouting on the same frequency — but registration only works if people check it.