What Port 2895 Is
Port 2895 is registered in the IANA Service Name and Transport Protocol Port Number Registry as NATUS LINK, assigned to Natus Medical — a company that makes neurological monitoring equipment: EEG systems, EMG analyzers, sleep study tools, and newborn brain monitors.1
The registration covers both TCP and UDP. Beyond the name and assignee, IANA documents nothing further about the protocol itself. NATUS LINK is a proprietary, internal communication protocol — not a public standard, not an RFC, not something you'll find a specification for.
What the Registered Port Range Means
Port 2895 sits in the registered ports range (1024–49151). This range is managed by IANA: companies and developers apply to reserve a port number for a specific service, and IANA records the assignment. It's a reservation system, not an enforcement system.
A registered port means:
- Someone asked IANA to record a name against this number
- The registration prevents two IANA-registered services from colliding on the same number
- It says nothing about how widely the protocol is deployed, or whether the protocol is documented publicly
Thousands of ports in this range are registered to proprietary enterprise or medical software that most of the world will never encounter. Port 2895 is one of them.
What NATUS LINK Actually Does
Natus Medical's software suite — NeuroWorks, SleepWorks, Natus Elite — connects neurological monitoring hardware to clinical workstations and hospital networks. Their systems handle EEG waveform capture, sleep study recordings, and EMG signal analysis.2
NATUS LINK is almost certainly the internal protocol these applications use to communicate: device-to-workstation, workstation-to-workstation, or software component-to-component. You would only see traffic on port 2895 if Natus Medical software is installed and running on the network.
If You See Port 2895 on Your System
If you see this port open and you're not running Natus Medical software, that's worth investigating. An unexpected open port in the registered range usually means:
- An application you've forgotten about
- A service that bound to this port incidentally (not NATUS LINK specifically — any application can use any unoccupied port)
- Rarely, something you didn't install yourself
To check what's listening:
On Linux or macOS:
On Windows:
The PID shown maps to a process in Task Manager or via tasklist /fi "PID eq <pid>".
Why Unassigned-in-Practice Ports Matter
The IANA registry is comprehensive but imperfect. Many registered ports belong to products that were discontinued, companies that were acquired, or protocols that were never widely deployed. NATUS LINK is registered, but it's functionally invisible on the public Internet.
This matters because the registered port range is finite and first-come, first-served. Every port reserved by a proprietary medical device protocol is a port unavailable for something else. The system works because most registered protocols stay well-separated in practice — hospital equipment and consumer software don't typically compete for the same port numbers.
Port 2895 is a small piece of evidence that the Internet's port space is more crowded, and more specialized, than it appears.
آیا دا پاڼه ګټوره وه؟