Port 2993: Veritas VIS1 — The Enterprise Reservation Nobody Remembers

What Port 2993 Is

Port 2993 sits in the registered ports range (1024–49151). These ports are assigned by IANA upon application — some by major vendors, some by individual developers, many by companies that have since been acquired, renamed, or dissolved.

Port 2993 is registered to veritas-vis1, a service associated with Veritas Technologies' storage management software. Veritas — originally part of VERITAS Software before its acquisition by Symantec, and later spun back out as an independent company — built enterprise backup and storage infrastructure that was ubiquitous in data centers through the 2000s and 2010s. Products like Backup Exec, NetBackup, and the Storage Foundation suite used a constellation of registered ports, and 2993 was one of them.¹

The "VIS" designation likely refers to a Veritas infrastructure service component, though the specific functional role of this port within the Veritas product suite is not well-documented in public sources. It's registered for both TCP and UDP.²

What the Registered Range Means

The registered range (1024–49151) is a middle ground between the well-known ports (0–1023), which require root/administrator privileges to bind on most systems, and the ephemeral range (49152–65535), which operating systems assign dynamically for outgoing connections.

Anyone can register a port with IANA, but the registry is not enforced. A process can bind to any unoccupied port regardless of what IANA says. This means:

• A registered assignment tells you what should be there
• It says nothing about what is there on any given system
• Seeing unexpected traffic on port 2993 doesn't mean Veritas is involved

If You See This Port

If port 2993 shows up in a scan or in your firewall logs:

Check what's listening:

# Linux/macOS
ss -tlnp | grep 2993
lsof -i :2993

# Windows
netstat -ano | findstr :2993

Check who's connecting:

# Capture traffic briefly
tcpdump -i any port 2993 -n

If you're running Veritas Backup Exec or NetBackup, this port may be legitimately in use by those services. If you're not running Veritas software and something is listening here, that's worth investigating — obscure registered ports are occasionally used by malware specifically because they're likely to be ignored.

Why Obscure Registrations Matter

The IANA registry holds thousands of entries like this one — registered by vendors for products that have since evolved, merged, or quietly faded. They occupy namespace in the registered range without much public documentation, which creates a gray zone: the port is "assigned," but the assignment provides little practical guidance to an administrator who encounters it.

This is a design tension in the port system. The registry exists to prevent collisions, but it was never intended to be authoritative documentation. For ports like 2993, the honest answer is: registered, obscure, and context-dependent.