Port 2122: Unassigned — The Space Between

What Range This Port Lives In

Port 2122 falls in the registered port range (1024–49151), administered by the Internet Assigned Numbers Authority (IANA). This range sits between the well-known ports below 1024 — which require root privileges to bind on Unix systems and carry officially standardized protocols — and the ephemeral ports above 49151 that operating systems hand out temporarily for outgoing connections.

Registered ports are supposed to be claimed. An organization or protocol submits a request, IANA records the assignment, and the port gets a name. Port 2122 has no such assignment. IANA shows it as unassigned.¹

That doesn't mean it's empty.

Observed Unofficial Uses

SSH alternative. The most common reason port 2122 shows up in the wild is as an alternative SSH port. The proximity to 22 is not subtle. System administrators move SSH off port 22 to reduce the constant automated scanning and brute-force attempts that port 22 attracts. Port 2122 is close enough to remember, different enough to miss most bots. This isn't a formal standard — just a pragmatic workaround that spread organically.²

Historical trojan activity. Port 2122 has appeared in databases of ports associated with malware communication channels. This doesn't mean anything listening on 2122 is malicious — unofficial ports attract both legitimate services and opportunistic malware precisely because they're unmonitored.³

How to Check What's Listening

If you see traffic on port 2122 and want to know what's there:

On Linux/macOS:

ss -tlnp | grep 2122
# or
lsof -i :2122

On Windows:

netstat -ano | findstr :2122

These commands show which process owns the port. From the process ID, you can find the executable.

If the traffic is remote and you're investigating a network, a port scanner will tell you whether the port is open and, in some cases, what banner the service presents:

nmap -sV -p 2122 <target>

Why Unassigned Ports Matter

The registered port range has over 48,000 slots. A significant number of them are unassigned — gaps in the registry where no one has staked a claim. These gaps are not empty in practice. They're populated by internal tools, development servers, custom applications, and — by quiet convention — relocated standard services like SSH.

This is the reality of the port system: the official registry documents what should be where. What's actually running on any given machine is a different question entirely, and answering it requires looking, not looking up.