Port 2948: WAP Push MMS — Where Picture Messages Arrived

What Range This Port Belongs To

Port 2948 sits in the registered port range (1024-49151). These ports are tracked by IANA, but "registered" doesn't mean every port in the range has an assigned service. Port 2948 carries no official IANA assignment — it's technically unassigned.

That said, "unassigned" and "unused" are not the same thing.

The WAP Push MMS Connection

Port 2948 has a well-documented de facto association with WAP Push MMS (Wireless Application Protocol Push, Multimedia Messaging Service) — the protocol responsible for delivering picture messages to mobile phones in the early 2000s.

Here's how it worked: when someone sent you an MMS, your carrier didn't push the full message directly to your phone. Instead, it sent a small WAP Push notification to your device — typically on port 2948 — telling your phone that a message was waiting and where to fetch it. Your phone would then connect to the carrier's MMS center to download the actual content.

It was a two-step dance. The push was just a knock on the door.

This port showed up across a wide range of hardware from that era: Windows Mobile devices, Sony Ericsson handsets (the W910i, W880i, K810i, and others), and various Nokia models. If you owned a phone between roughly 2002 and 2010, traffic likely touched this port.

Security History

The WAP Push mechanism had real vulnerabilities.

A 2009 CVE documented that certain Sony Ericsson phones could be caused to reboot or hang by sending a malformed WAP Push packet to port 2948.¹ No authentication required. No user interaction. Send one bad packet, crash the phone.

ArcSoft MMS Composer — a popular third-party MMS client — had a similar issue in 2006: malicious WAP Push messages could exhaust resources and crash the application.²

Both are patched now, and WAP Push is largely obsolete. But the pattern is worth remembering: small, underexamined protocols running on edge devices tend to get less security scrutiny than servers. Your flip phone had an attack surface.

How to Check What's Listening on This Port

If you see traffic on port 2948 on a modern system, here's how to investigate:

On Linux/macOS:

# Show what process is listening on port 2948
ss -tlnp | grep 2948
# or
lsof -i :2948

On Windows:

netstat -ano | findstr :2948

Match the PID from netstat to a process name using Task Manager or:

tasklist | findstr <PID>

On a modern desktop or server, nothing should be listening here. If something is, it's worth understanding what and why.

Why Unassigned Ports Matter

The registered port range has 48,128 slots. Many are assigned, many are not. The unassigned ones aren't wasted — they're available for applications to use by convention, even without IANA blessing.

Port 2948 is a good example of how informal conventions develop: carriers and device manufacturers settled on this port for WAP Push delivery, it spread across an entire generation of mobile hardware, and now it sits quietly unassigned while the protocol it once carried has been replaced by iMessage, WhatsApp, and everything that came after.

The Internet is full of these geological layers. Ports that meant something once, used by protocols that solved real problems, now dormant but not forgotten.