Port 2840: l3-exprt — A Name on a List

What Range This Port Belongs To

Port 2840 falls in the registered ports range (1024–49151). This range is administered by IANA, and ports in it are assigned upon application — a company or working group asks for a port number, IANA records it, and the assignment enters the registry.

Unlike the well-known ports (0–1023), registered ports don't require root privileges to open on most operating systems. They're the middle ground: officially tracked, but not protected.

The Official Assignment: l3-exprt

IANA's registry lists port 2840 (TCP and UDP) as assigned to l3-exprt, which stands for "Layer 3 Expert." The name suggests something in the networking infrastructure space — Layer 3 being the network layer in the OSI model, where IP addressing and routing live.

In practice, this registration is effectively dead. No widely-deployed software uses this port. No RFC documents the protocol. No major network scanner fingerprint database associates it with running services. The assignment exists as a name in a text file, pointing to something that either never shipped or quietly disappeared.¹

This is more common than you'd think. The registered port range has thousands of entries. Many were claimed during the protocol proliferation of the 1990s and early 2000s by projects that didn't survive, were absorbed into other systems, or simply never launched.

Security Notes

Some security databases flag port 2840 as having been used by malware at some point, without naming a specific trojan.² This vague flag is common for obscure ports — attackers sometimes pick unassigned or lightly-used ports precisely because they generate less alarm. An open port 80 is expected. An open port 2840 is a question.

If you see port 2840 open on a machine you manage and you didn't open it, investigate.

How to Check What's Listening

On Linux/macOS:

ss -tlnp | grep 2840
# or
lsof -i :2840

On Windows:

netstat -ano | findstr :2840
# Then look up the PID:
tasklist | findstr <PID>

These commands tell you the process name and ID holding the port open. That's where the investigation starts.

Why Unassigned Ports Matter

The port registry exists to reduce collisions — so two applications don't accidentally choose the same number and step on each other. But the system depends on software actually honoring assignments, and software doesn't always ask.

Unassigned and lightly-used ports like 2840 are the gaps in the map. They're not empty — anything can listen there. They're just not labeled with a known tenant. For defenders, that makes them worth watching. For attackers, that makes them attractive.