Port 2872: Radix — A Name Without a Protocol

What Port 2872 Is

Port 2872 sits in the registered port range — ports 1024 through 49151 that IANA maintains for services that have applied for a reservation. Unlike the well-known ports below 1024 (HTTP, SSH, SMTP), registered ports don't require privileged access to bind. Anyone can run a service on them. Anyone can also request a reservation.

The IANA registry lists port 2872 as "radix" on both TCP and UDP, registered in July 2011 by a private individual named Stein Roger Skaflotten.¹ That's where the trail ends. There is no associated RFC, no public specification, no known software that identifies itself as the "radix" protocol on this port. The registration exists; the protocol, in any documented sense, does not.

This is more common than you'd think. The registered port space contains hundreds of reservations that were claimed and then abandoned, never implemented, or used privately without public documentation. The name "radix" is also genuinely ambiguous — it could refer to a database protocol, a networking concept, a proprietary application, or simply a name someone liked in 2011.

What You Might Actually Find Here

Because port 2872 has no established service, anything listening on it is application-specific. Common real-world explanations:

• Custom application traffic — Internal tools, game servers, or proprietary software that picked this port because nothing else was using it
• Development servers — Developers often choose arbitrary registered ports for local services
• Malware — Uncommon on this specific port, but unassigned-in-practice ports are occasionally used by software that wants to avoid scrutiny

How to Check What's Using This Port

If you see traffic on port 2872 and want to know why:

# On Linux/macOS — show the process bound to port 2872
sudo lsof -i :2872

# Alternative using ss (Linux)
sudo ss -tlnp | grep 2872

# On Windows
netstat -ano | findstr :2872
# Then look up the PID:
tasklist | findstr <PID>

On a firewall or router, unexpected traffic to port 2872 from external sources is worth investigating. No legitimate public service is expected here.

Why the Registered Range Matters

The registered port range exists so that services can have stable, predictable homes. When a protocol has a reservation, software can default to that port and users can configure firewalls with confidence. Without reservations, two different applications might both want the same port and conflict.

But the system relies on registrants actually building and documenting what they claimed. Port 2872 is a small reminder that a name in a registry isn't the same as a working protocol — and that the Internet's addressing space, like any public resource, contains plenty of unclaimed land.