Port 2953: OV Alarm Server — HP OpenView's alarm backbone

What This Port Is

Port 2953 sits in the registered ports range (1024–49151), the middle band of the port number space. Ports in this range are assigned by IANA to specific services, but unlike well-known ports (0–1023), they don't require elevated privileges to bind. Any process can open a socket on port 2953.

IANA lists this port as ovalarmsrv — the OV Alarm Server — on both TCP and UDP.¹

What OVALARMSRV Was

The OV Alarm Server was a daemon inside HP OpenView Network Node Manager (NNM), an enterprise network management platform that dominated corporate IT infrastructure from the 1990s through the early 2000s.

HP OpenView NNM used SNMP to continuously poll network devices — routers, switches, servers — and collect their health status. When something went wrong, an alarm was generated. The OV Alarm Server was where those alarms landed: a central process that received, stored, and served alarm data to the operator consoles watching the network.

Port 2953 was the door to that alarm server — the endpoint that NNM components used to query current alarm state and receive new alerts.

Who Still Uses This

Almost nobody. HP OpenView NNM was acquired by Hewlett-Packard, then passed to Micro Focus, and eventually to OpenText after Micro Focus's acquisition in 2023.² The product still exists in some large enterprise environments, particularly in telecommunications companies and government networks that built infrastructure around it decades ago and haven't completed migration.

If you see port 2953 active on a modern system, it's almost certainly legacy OpenView infrastructure — or something unrelated using the port opportunistically.

Checking What's Listening

# Linux/macOS
ss -tlnp | grep 2953
lsof -i :2953

# Windows
netstat -ano | findstr :2953

If something is listening, cross-reference the process ID against your running processes to identify it. On a modern system with no legacy network management software, nothing should be bound to this port.

Why Unassigned Ports Matter

The registered port range contains roughly 48,000 port numbers. Many are assigned to services that no longer exist, were never widely deployed, or belong to software products that have been discontinued. Port 2953 is a mild example of this: officially assigned, rarely active.

This matters because firewalls and security tools often use port numbers as signals. An active registered port with no known corresponding software on your system is worth investigating — it could be an application you've forgotten, or something you didn't install intentionally.