Port 2427: MGCP — Where Dumb Phones Take Orders

What Port 2427 Does

Port 2427 (UDP) is the listening port for MGCP media gateways — the hardware that converts between traditional phone circuits and IP networks.

When a call arrives, the gateway doesn't decide what to do. It waits. A separate server called the Call Agent sends commands to port 2427: create a connection, modify a connection, delete a connection. The gateway executes. This is MGCP's entire philosophy: keep the endpoints simple, put the brains in the center.¹

The Call Agent side of the conversation happens on port 2727. Two ports, one protocol, a clear division of authority.

How MGCP Works

MGCP stands for Media Gateway Control Protocol. It's a master-slave protocol — the Call Agent masters, the gateway obeys.

The gateway's job is conversion: analog voice to IP packets, PSTN signaling to IP signaling. It's essentially a translator with no opinions. When a phone rings, the gateway reports the event to the Call Agent. The Call Agent decides what to do and sends back instructions. The gateway follows them.

Commands travel as plain text over UDP. A typical exchange looks like this:

CRCX 1204 aaln/1@gateway.example.com MGCP 1.0
C: A3C47F21456789F0
L: p:20, a:PCMU
M: recvonly

CRCX means "Create Connection." The Call Agent is telling the gateway to open a voice channel on the line labeled aaln/1, using G.711 PCMU audio, ready to receive. The gateway responds with a session description and waits.²

This text-based simplicity was deliberate. The gateways needed to be cheap. The intelligence — routing logic, dial plans, billing, features — lived on the Call Agent server where it could be updated, monitored, and scaled centrally.

The History

The late 1990s were a collision between two worlds: the telephone network (reliable, expensive, circuit-switched) and the Internet (unreliable, cheap, packet-switched). Carriers wanted the Internet's economics without abandoning their existing infrastructure.

MGCP emerged from this collision. The early version, SGCP (Simple Gateway Control Protocol), was developed at Telcordia and Level 3 Communications around 1998. Cisco and others extended it into MGCP, and the IETF published the first RFC in 1999 (RFC 2705). The revised version, RFC 3435, followed in January 2003.³

The protocol reflected a telephone-company mindset: centralized control, dumb terminals, intelligence in the network. This was how the PSTN had always worked. MGCP was essentially the PSTN's control model, re-implemented over IP.

Port 2427 was assigned by IANA as the standard gateway port. Cisco's implementation became widespread enough that some sources label it "cisco-mgcp" — a reminder of how much of early VoIP infrastructure ran on Cisco gear.

Why MGCP Lost

MGCP made a bet: the future of VoIP would look like the telephone network, just cheaper. SIP made the opposite bet: every endpoint is intelligent, calls are negotiated peer-to-peer, there is no master.

SIP won.

The centralized model that made MGCP appealing to carriers made it brittle. When the Call Agent went down, every gateway it controlled went silent. Scaling required bigger, more expensive call agents. And as end-user devices got smarter — softphones, IP desk phones, mobile apps — the "dumb terminal" model became a constraint rather than a feature.

MGCP found a lasting home in a specific niche: analog telephone adapters (ATAs) and voice gateways where you genuinely want dumb hardware controlled by a service provider. Some cable company VoIP services still use MGCP on exactly this model.⁴

Security Considerations

MGCP has no built-in authentication. Commands arriving on port 2427 are trusted by default — there's no handshake, no credential check. Early deployments assumed the gateway and Call Agent lived on a private network where external traffic never reached them.

That assumption doesn't always hold. If port 2427 is reachable from the Internet, an attacker can send MGCP commands directly: delete connections, redirect audio streams, manipulate calls. MGCP gateways should sit behind firewalls that restrict access to port 2427 from authorized Call Agents only.⁵

UDP's lack of connection state makes this worse. There's nothing to block a spoofed source IP from injecting commands.

Related Ports

How to Check What's Listening

# Linux/macOS — show what's using UDP port 2427
sudo ss -ulnp | grep 2427

# Or with lsof
sudo lsof -iUDP:2427

# Windows
netstat -ano | findstr :2427

If you see something listening on port 2427, you're likely looking at VoIP gateway software — either a hardware ATA's management daemon, Cisco CallManager, or a legacy PBX system.