Port 2917: Elvin Client — A registered port for a protocol the world forgot

What This Port Does

Port 2917 is officially registered with IANA as elvin_client — the client-facing port of the Elvin notification system. Its companion, the Elvin Server, listens on port 2916. Together, they form a two-port pair for a publish/subscribe messaging architecture that predates the tools that eventually dominated that space.

In practice, you are unlikely to encounter traffic on this port. Elvin never achieved broad deployment.

What Elvin Was

Elvin was a distributed event notification system built at the Distributed Systems Technology Centre (DSTC) at the University of Queensland, Australia, in the late 1990s. It used a content-based subscription model: instead of subscribing to a named topic, clients subscribed using boolean expressions that filtered incoming events by their actual content. A client could say, in effect, "give me any event where severity > 3 and system = 'database'".¹

That was genuinely novel at the time. Elvin's content-based routing put it ahead of many contemporaries in flexibility.

The problem: the world moved on. Apache Kafka, MQTT, AMQP, and similar systems absorbed the use cases Elvin was designed for, backed by larger communities and commercial adoption. Elvin's IANA port registrations remain on the books — two quiet placeholders for a protocol that nearly no production system uses today.²

The Registered Port Range

Port 2917 sits in the registered port range (1024–49151). This range is managed by IANA, where vendors and developers can formally register ports for specific services. Registration means:

• A service name is officially associated with the port number
• The assignment is documented in the IANA Service Name and Transport Protocol Port Number Registry
• No enforcement — any process can open any port; registration is documentation, not access control

Most registered ports have a similar story: a legitimate service requested the assignment, used it in some form, and then either thrived (port 3306, MySQL; port 5432, PostgreSQL) or quietly faded (port 2917).

If You See This Port Open

If port 2917 shows up in a port scan or in your firewall logs, it is almost certainly not Elvin. The more likely explanations:

• A custom application chose this port arbitrarily
• A development server is running on a high-numbered port
• Malware chose it precisely because it looks unremarkable

To find what's actually listening:

# Linux/macOS
sudo ss -tlnp | grep 2917
sudo lsof -i :2917

# macOS alternative
sudo netstat -anv | grep 2917

# Windows
netstat -ano | findstr :2917
# Then match the PID: tasklist | findstr <PID>

If something is listening and you didn't put it there, that's worth investigating.

Why Unassigned (and Abandoned) Ports Matter

The registered port range contains thousands of entries like this one — protocols that were real, registered, and then superseded. They're not wasted space exactly, but they're not truly available either. IANA keeps them reserved to avoid ambiguity: if 2917 were "unassigned," some future protocol might claim it and then collide with any legacy Elvin deployment still running somewhere.

This is how the port registry accumulates technical debt. Not through bad intentions — through the normal process of technology evolving faster than registries get cleaned up.