Port 2418: cas — The Ghost Registration

What Range This Port Belongs To

Port 2418 sits in the registered ports range (1024–49151), also called the user ports range. This is the middle tier of port space, between the well-known ports (0–1023) that are tightly controlled and require root privileges to bind, and the ephemeral ports (49152–65535) that operating systems assign dynamically to outgoing connections.

Registered ports are claimed through IANA — anyone can submit an application, describe a service, and receive an assignment. IANA doesn't test or validate the software; it maintains the registry as a directory, not a certification. The result is a range that contains everything from critical infrastructure (port 1433 for Microsoft SQL Server, port 3306 for MySQL) to half-finished projects that never shipped.

Port 2418 is the latter kind.

The IANA Registration

Port 2418 is registered for a service called cas — both TCP and UDP. The registrant is Akiyoshi Ochi, an engineer whose email address places them at Fujitsu's networking division. The registration appears to date from the late 1990s, during the era when anyone building enterprise software could reserve a port for future use.

The description in IANA's registry? "cas."

That's it. No expansion of the acronym. No RFC. No reference implementation. No indication of what problem it was meant to solve. The port is technically claimed, but the claim is a locked door with no address on the front.

If "cas" stands for something — perhaps a Fujitsu-internal communications or authentication service — that knowledge never made it into any public documentation.¹

The Only Known Tenant: Intruzzo

The most documented activity on port 2418 belongs to Backdoor:Win32/Intruzzo.A, a backdoor trojan catalogued by Microsoft and Symantec.

Intruzzo opened a listening connection on port 2418, allowing a remote attacker to execute commands on the infected machine. This was not an exploit of a legitimate service — there was no legitimate service to exploit. Intruzzo simply squatted on a quiet, unmonitored port that no firewall rule was watching because no known application used it. That's the logic of using an obscure registered port: it's assigned enough to seem legitimate in a port scan, but unused enough that nobody looks twice.²

Intruzzo is old malware, not circulating actively today. But the pattern it exploited — hiding in the gap between the official record and actual use — is evergreen.

Why Unassigned-in-Practice Ports Matter

Port space has an official map and a real map. They diverge constantly.

The official map has 65,535 ports. The real map has the few hundred that any given network actually uses. Everything in between is dark matter — ports that are registered but dormant, unregistered but actively used by applications, or claimed by software that was discontinued decades ago.

Firewalls that block by default and only open what's needed treat this dark matter correctly: if nothing is supposed to use port 2418, nothing should be able to. But firewalls configured the other way — block known bad ports, allow everything else — leave gaps wherever the official registry doesn't match reality.

Port 2418 is a small illustration of a large principle: the map is not the territory.

How to Check What's Listening on This Port

If you see traffic on port 2418 or want to verify nothing is listening:

On Linux/macOS:

# Show what process is listening on port 2418
ss -tlnp | grep 2418

# Or with lsof
lsof -i :2418

On Windows:

netstat -ano | findstr :2418

If something is listening on port 2418 and you don't recognize it, that's worth investigating. The legitimate use case for this port is essentially nil.