Port 2007: DECtalk and RAID-AM — Two Ghost Registrations

Port 2007 sits in the registered ports range (1024–49151), the middle tier of the port number system. These ports aren't reserved for core Internet infrastructure like the well-known ports below 1024. They're registered by organizations that wanted a stable, official home for their application protocols.

Port 2007 has two such registrations. Neither is likely to be what's running on your system if you see this port open today.

What's Registered Here

TCP 2007 — DECtalk

DECtalk was a text-to-speech synthesizer built by Digital Equipment Corporation (DEC) in 1984, based on research by MIT's Dennis Klatt.¹ It produced speech from text using formant synthesis—a technique that models the human vocal tract mathematically rather than stitching together recorded sounds.

DECtalk is best known as the voice Stephen Hawking used for decades. He adopted it after losing his speech in 1985 and kept using it even as better-sounding alternatives emerged, because the voice had become part of how people recognized him.

A network protocol was registered for DECtalk on TCP port 2007, presumably for systems where a DECtalk device needed to accept text input over a network connection rather than a serial port. Whether this protocol saw significant deployment is unclear. The registrations in port databases are sparse and trace back to early Nmap service detection records rather than active documentation.²

UDP 2007 — RAID-AM

The UDP assignment belongs to RAID-AM, part of a cluster of RAID-related administrative services that occupy the port range around 2007–2014. "RAID-AM" likely refers to a RAID array management protocol, though no public RFC or specification appears to document exactly what it does or who registered it.³

What This Means for You

If you scan a system and find port 2007 open, you're almost certainly not looking at DECtalk or RAID-AM. Both registrations are historical artifacts. What you're more likely seeing is:

• A custom application that chose this port
• Development or test software
• A misconfigured service

Check what's actually there:

# On Linux/macOS — see what process owns port 2007
sudo lsof -i :2007

# Or with ss
sudo ss -tlnp | grep 2007

# On Windows
netstat -ano | findstr :2007

The process name and path will tell you more than the port number ever could.

Why Unassigned and Ghost Ports Matter

The registered ports range contains thousands of ports like this one—officially registered, rarely used, sometimes by software that no longer exists. This matters for two reasons.

Security scanning: Port scanners flag open ports based on known registrations. An open port 2007 flagged as "dectalk" isn't actually a DECtalk threat—but it does mean something unexpected is running, which is worth investigating.

Port selection: When developers need a port for a new application, they often pick numbers that feel arbitrary. Many of those "arbitrary" numbers turn out to have ghost registrations. The responsible path is checking the IANA registry before committing to a port number in software you'll distribute.

Port 2007 is a small museum: a speech synthesizer that became the voice of one of the greatest physicists alive, and a storage management protocol that left almost no documentation behind. Both registered their ports, both faded from use, and now the number sits waiting for whatever runs there next.