Port 2944: Megaco/H.248 — The Voice of the Bridge

Port 2944 is the text-mode port for Megaco/H.248, a protocol designed to control media gateways — the devices that translate voice calls between the traditional public switched telephone network (PSTN) and IP-based networks.

Its binary companion lives at port 2945. Same protocol, different encoding.

The Problem It Solved

In the late 1990s, telephone networks and IP networks were two separate worlds. The PSTN ran on circuit-switched infrastructure built over decades. The Internet ran on packets. VoIP was emerging, but you couldn't just bridge the two worlds by wishing them compatible.

Media gateways were the translators. A media gateway converts audio — the actual voice signal — between formats: analog or digital PSTN audio on one side, RTP packets on the other. But a translator needs instructions. Something had to tell the gateway: accept this call, connect it to that endpoint, hang up now.

That something was Megaco/H.248.

How It Works

H.248 uses a controller/gateway split. A Media Gateway Controller (MGC) — sometimes called a softswitch — sends commands to one or more Media Gateways (MGs). The gateway handles the actual media conversion; the controller handles the call logic.

The protocol models everything in terms of terminations (endpoints that can send or receive media) and contexts (connections between terminations). A controller adds terminations to a context to connect a call, modifies them to change the media path, and subtracts them to hang up.

Port 2944 carries this signaling in plain text. Port 2945 carries the same protocol encoded in binary ASN.1 — more compact, less readable. In practice, text mode was common in testing and smaller deployments; binary appeared in high-volume carrier infrastructure where efficiency mattered.

Where It Came From

H.248 was unusual because it had two parents.

The IETF MEGACO working group developed it under the name Megaco and published it as RFC 3015 in 2000, later updated by RFC 3525. The ITU-T Study Group 16 developed the same protocol simultaneously as H.248. Both bodies coordinated closely enough that the result was a single standard with two names — depending on whether you called it by its IETF name or its ITU designation.¹²

RFC 3525 has since been reclassified as Historic (the ITU-T H.248.1 recommendations are now the living standard), but the IANA port assignments — including 2944 and 2945 — remain in force.³

Why It's Quieter Now

H.248 belongs to an era of managed carrier infrastructure: large telecom operators running sophisticated softswitch deployments, controlling racks of media gateways that handled millions of minutes of voice traffic. That architecture is still out there, but SIP has absorbed much of the newer VoIP deployment space, and the great migration from PSTN to IP is largely complete.

You're more likely to encounter H.248 in carrier-grade telecom equipment and legacy enterprise telephony than in new deployments.

What's on Port 2944 on Your Machine

Almost certainly nothing, unless you're running telecom infrastructure.

# macOS / Linux — check what's listening on 2944
sudo lsof -i :2944

# or with ss (Linux)
ss -tlnp sport = :2944

# Windows
netstat -ano | findstr :2944

If something is there and you're not running a media gateway controller, it's worth investigating.