What Range This Port Belongs To
Port 2428 sits in the registered ports range (1024–49151). IANA maintains this range for applications and services that have formally registered their use. Registration doesn't mean the service is widely deployed — it means someone filled out the paperwork.
Any port in this range can be used freely by applications on your machine as a source port for outbound connections. But as a destination port, 2428 belongs to OTT.
The Official Assignment: OTT
IANA has assigned port 2428 (both TCP and UDP) to OTT — One Way Trip Time, registered by Greg Troxel of BBN Technologies.1
OTT is a network measurement protocol designed to measure one-way latency across IP paths. One-way delay measurement matters because Internet paths are often asymmetric — the route from A to B is frequently different from the route from B to A. Round-trip time hides this. OTT exposes it.
BBN Technologies (now Raytheon BBN) has been doing foundational Internet research since the days of ARPANET. Troxel's work sits in the tradition of IETF's IP Performance Metrics (IPPM) working group, which produced standards like RFC 2679 for one-way delay and RFC 7679, its successor.2
OTT never became a widely deployed protocol. The port is registered; the service is not something you're likely to find listening on a production server.
The Unofficial Use: Cisco MGCP
In Cisco voice deployments, port 2428 has a second life.
MGCP (Media Gateway Control Protocol) is a protocol for controlling telephone gateways from a central call agent — in Cisco's case, Unified Communications Manager (CUCM). When a Cisco voice gateway uses MGCP with PRI (Primary Rate Interface) trunks, it opens a TCP connection to port 2428 on the CUCM server for PRI backhaul and keepalive traffic.3
This is how the gateway says "I'm still here" to the call manager, and how signaling for PRI channels gets relayed. If you see TCP traffic on port 2428 in a Cisco telephony environment, that's what you're looking at.
MGCP's primary signaling runs on UDP port 2427. Port 2428 is the TCP companion for backhaul.
How to Check What's Listening on This Port
On Linux or macOS:
On Windows:
With nmap (from another host):
If you find something listening on 2428 in a Cisco CUCM environment, it's almost certainly MGCP backhaul. Elsewhere, it's likely a coincidence — an ephemeral connection or a service that picked the port informally.
Why Unassigned (or Lightly Used) Ports Matter
The registered port range exists so applications don't collide. Without registration, two services might independently choose the same port and break each other. IANA's registry is the reservation system — it's why your SSH client knows to try port 22 and your browser knows to try 443.
But registration is voluntary for registered ports, and enforcement is nonexistent. Real-world port usage often diverges from the registry. Services squat on registered ports. Ports are registered and then abandoned. The registry is a map — and like all maps, it's slightly wrong in places.
Port 2428 is a minor illustration of this: officially OTT, functionally Cisco MGCP in many environments, and probably neither on most machines where it appears.
Was deze pagina nuttig?