Port 2788: fryeserv — A Ghost in the Registry

What This Port Is

Port 2788 sits in the registered ports range (1024–49151). These are ports that applications and services can claim through IANA — the Internet Assigned Numbers Authority — by filing a registration. Unlike well-known ports (0–1023), registered ports don't require root or administrator privileges to use. Anyone can run a service on them.

Port 2788 has an official name in the IANA registry: fryeserv. The description reads "NetWare Loadable Module - Seagate Software." The contact listed is Joseph LoPilato.¹

That registration is the entire paper trail.

The Story Behind the Name

In the 1990s, Novell's NetWare was the dominant network operating system for corporate environments — the thing that made office file sharing and print servers work before Windows Server took over. NetWare ran on a module system called NLMs (NetWare Loadable Modules), small programs that could be loaded into the server kernel to add functionality.

Frye Utilities was a company that made tools for managing NetWare networks — monitoring, auditing, asset tracking. In the mid-1990s, Seagate Technology (yes, the hard drive company) acquired Frye Utilities as part of a brief expansion into enterprise software, eventually folding it into what became Seagate Software. The "frye" in "fryeserv" is that acquisition's fingerprint.

Seagate Software was later spun off and became Crystalreports — and eventually Crystal Reports was absorbed into Business Objects, which was absorbed into SAP. The NetWare management tools that once needed port 2788 didn't survive the journey.²

Who Uses This Port Today

Almost certainly no one is running fryeserv. NetWare itself was officially end-of-lifed by Novell in 2009, and active NetWare deployments had been dwindling for a decade before that.

In practice, port 2788 is unoccupied on nearly every machine. It belongs to no modern software ecosystem. Some port scanners flag the 2700–2800 range as historically associated with KnowShowGo P2P software, but that too is defunct.³

If you see port 2788 open on a system, it isn't fryeserv. It's something else — a custom application, a misconfigured service, or something worth investigating.

How to Check What's Listening

On Linux or macOS:

ss -tlnp | grep 2788
# or
lsof -i :2788

On Windows:

netstat -ano | findstr :2788
# Then look up the PID:
tasklist | findstr <PID>

If nothing appears, nothing is listening. That's the expected result.

Why Unassigned (or Ghost) Ports Matter

The IANA registry is a coordination mechanism, not a lock. Registering a port doesn't prevent someone else from using it — it just establishes a record of intent. When software dies and its port registration goes cold, that number becomes available for new applications to use informally.

Ghost registrations like fryeserv matter because they can cause confusion. A port scanner might flag 2788 as "fryeserv" when the actual service running there has nothing to do with NetWare. Always verify with ss or lsof rather than trusting a port number alone.

Related Ports

• Port 524 — NCP (NetWare Core Protocol), the primary NetWare communication protocol
• Port 396 — Novell Netware over IP
• Port 2638 — Sybase SQL Anywhere (another relic from the same enterprise software era)