Port 2854: InfoMover — A Registered Ghost

What Port 2854 Is

Port 2854 sits in the registered ports range (1024–49151), the middle tier of the port numbering system. These ports are assigned by IANA on request — anyone can apply for one, and IANA records the assignment in its Service Name and Transport Protocol Port Number Registry.

Port 2854 is registered. The service name is infomover, assigned to both TCP and UDP. The assignee contact is listed as Carla Caputo.

That's where the paper trail ends.

What InfoMover Was

EMC (now Dell EMC) produced a file archival and transfer product called InfoMover — software that moved data between network-attached storage systems and tape archives or other storage tiers. It was a product of the pre-cloud era, when "tiered storage" meant physically different hardware and software had to coordinate the movement between them.

The InfoMover File Transfer 3.7 User's Guide exists in Dell's documentation archive, confirming the product was real. What doesn't exist is any documentation connecting it to port 2854 specifically. The port registration appears to have been made, the product evolved or was retired, and port 2854 was never reclaimed.

This is not unusual. IANA registrations are rarely revoked. A port number is cheap to register and costs nothing to hold indefinitely.

What This Means for You

If you see traffic on port 2854 on a modern network, it's almost certainly not InfoMover. It could be:

• Custom software using the port opportunistically (unassigned-in-practice ports are attractive for this)
• Malware using an obscure registered port to blend in
• Legitimate application traffic from software that chose this port without consulting IANA

No meaning should be assumed either way. Check what's actually listening.

How to Check What's Listening

On Linux/macOS:

# Show what process is using port 2854
sudo lsof -i :2854

# Alternative with ss (Linux)
sudo ss -tlnp sport = :2854

On Windows:

# Show all listening ports with process IDs
netstat -ano | findstr :2854

# Get the process name from the PID
tasklist | findstr <PID>

With nmap (scanning a remote host):

nmap -sV -p 2854 <target-ip>

The -sV flag attempts to identify the service version — useful when you need more than just "something is listening."

Why Unassigned-in-Practice Ports Exist

The registered ports range contains 48,128 ports. Most of them have thin or no real-world presence. IANA assigned them to products, projects, or companies that moved on. The registration stays; the software doesn't.

This creates a practical reality: the registered ports range is not a reliable map of what's actually running on your network. It's a historical record of requests, many of which describe software that no longer exists.

Port 2854 is an honest example of this. A name, a contact, a protocol. No documentation, no active community, no traffic anyone has publicly reported. The bureaucracy outlasted the product.