Port 2540: LonWorks — The Building's Nervous System

What This Port Does

Port 2540 is officially registered with IANA for LonWorks (service name: lonworks), alongside its companion port 2541 (lonworks2). Both TCP and UDP are assigned.¹

LonWorks is a networking protocol for building automation — the technology that lets an HVAC controller, a lighting system, and a fire alarm panel all share a network without any of them being in charge.

LonWorks: What It Is

Echelon Corporation created LonWorks in 1988 to solve a specific problem: industrial and commercial buildings were full of devices from different manufacturers, all speaking incompatible languages, all requiring separate wiring. Elevators didn't talk to HVAC. Lighting didn't talk to occupancy sensors. Every system was an island.²

LonWorks addressed this with the LonTalk protocol — a peer-to-peer design where any node can initiate communication with any other node. No master device. No polling hierarchy. Just nodes on a network, each with an address, exchanging typed data through "network variables" that other devices can subscribe to.

A temperature sensor publishes its reading. The HVAC controller subscribes. The lighting system subscribes too, if it wants. That's the model.

The protocol became ISO/IEC 14908 in 2008, cementing its place as an open standard for building control networks.³

Port 2540 vs. How LonWorks Actually Runs over IP

Here's the honest complexity: most LonWorks-over-IP traffic doesn't use port 2540.

The dominant standard for tunneling LonWorks packets over TCP/IP is IP-852 (also called CEA-852 or EIA-852), and it operates on ports 1628 and 1629 by default.⁴ This is what Echelon's i.LON products use, and what most documentation covers.

Port 2540's specific role within the LonWorks ecosystem is not well documented publicly. IANA records the assignment, and it appears in port reference databases, but the relationship between port 2540 and port 1628/1629 in actual deployments is unclear from available documentation. It may represent a secondary or legacy mechanism, or a capability in the protocol suite that never saw wide deployment.

Who Uses It

LonWorks has tens of millions of nodes installed in office buildings, airports, factories, and campuses — mostly invisible infrastructure. If the building you're in has automated lighting, central HVAC control, or an integrated access system, there's a reasonable chance LonWorks is involved somewhere.

Port 2540 traffic in a network capture almost certainly means you're looking at a building automation system, not consumer or enterprise software.

Checking What's Using Port 2540

If you see this port active on a machine and want to know what's listening:

macOS / Linux:

sudo lsof -i :2540
sudo ss -tlnp sport = :2540

Windows:

netstat -ano | findstr :2540

Match the PID to a process name in Task Manager or with tasklist /fi "pid eq <PID>".

On a building automation controller or gateway, port 2540 activity is expected. On a general-purpose server or workstation, it warrants investigation.

The Registered Ports Range

Port 2540 sits in the registered ports range (1024–49151). These ports are assigned by IANA for specific services upon application — they require a request and review, unlike the free-for-all of the dynamic/ephemeral range.⁵

Registration doesn't mean enforcement. Any process on your system can bind to any port not already in use, regardless of what IANA says. The registry is a coordination mechanism, not a lock.

Related Ports