Port 2950: ESIP — The Library Self-Checkout Protocol

What This Port Does

Port 2950 is registered with IANA for ESIP — the Extended Standard Interchange Protocol. It operates on both TCP and UDP, though TCP is the relevant transport for its actual use.

This is a registered port, sitting in the 1024–49151 range. Registered ports are assigned by IANA to specific applications and services. They don't require elevated privileges to open (unlike well-known ports below 1024), and they're not randomly ephemeral (unlike dynamic ports above 49151). They're the middle tier: claimed, catalogued, and waiting.

Port 2950 is claimed. It just happens to be claimed by something almost nobody has heard of.

What ESIP Is

ESIP stands for Extended SIP — but not VoIP SIP. This is the Standard Interchange Protocol, a completely different SIP.

3M (yes, the tape and Post-it notes company) published the Standard Interchange Protocol in 1993 to solve a specific problem: how do library self-checkout machines talk to library management systems? The protocol let kiosks query patron accounts, check out books, process returns, and validate borrowing privileges — all in real time over TCP/IP.

Version 2.0 (SIP2), published in 2006, became the de facto standard across the library automation industry. Vendors like Bibliotheca, Envisionware, Checkpoint, and open-source systems like Koha and Evergreen all adopted it. In 2012, 3M donated the protocol to the National Information Standards Organization (NISO), which shepherded it through formal standardization.¹

ESIP extends SIP2 with additional messaging capabilities beyond the base standard. Ex Libris Voyager — a major library management system used by universities and public libraries — uses ESIP for self-check integrations that require features the standard SIP2 messages don't cover.² When a Voyager system sends a status message (Message 99, SC Status) with a value of "Y" for the ESIP field, it signals that extended messaging is available.

Port 2950 is where that conversation happens.

What Runs in This Range

Port 2950 sits in the registered port range (1024–49151). IANA maintains the official list of assignments in this range, though not all ports are assigned — and many assigned ports belong to services that never achieved wide deployment.

ESIP on port 2950 is a real assignment with a real use case, but it's narrow: library management software in institutional environments. You won't encounter it on a home network or a typical web server. You might encounter it in the network traffic of a university library running Voyager.

Security Context

Port 2950 has appeared on older lists of ports flagged for trojan activity, which is common for any port in the registered range that doesn't belong to a universally recognized service. An unfamiliar open port raises suspicion — that's reasonable. But the flag predates widespread knowledge of ESIP's registration, and there's no documented malware family specifically associated with this port.

The honest answer: if you see port 2950 open on a library server running Ex Libris Voyager, it's almost certainly the self-check service. If you see it open on an unexpected machine, investigate.

How to Check What's Listening

# On Linux/macOS — show process using port 2950
sudo lsof -i :2950

# Or with ss (Linux)
sudo ss -tlnp | grep 2950

# On Windows
netstat -ano | findstr :2950
# Then look up the PID:
tasklist | findstr <PID>