Port 2785: aic-np — A Name Without a Protocol

What This Port Is

Port 2785 falls in the registered ports range (1024–49151). These are ports that individuals, companies, and projects have applied to IANA to reserve for a specific use — distinct from the well-known ports (0–1023) that major protocols like HTTP, SSH, and DNS live on.

The IANA registry lists port 2785 as assigned to a service called aic-np, over both TCP and UDP, registered by someone named Brad Parker. The adjacent port, 2786, is also registered by the same person for a service called aic-oncrpc — suggesting "aic" is a shared prefix and "np" likely stands for "Name Protocol," paired with an ONC-RPC (Open Network Computing Remote Procedure Call) variant next door.

That's the full extent of the public record. No RFC. No specification. No known implementation. No mention in security databases. The registration happened, and then nothing followed it into the world.

Ghost Registrations

This is more common than it sounds. During the 1990s and early 2000s, IANA accepted port registrations fairly freely. Companies and developers could claim a port number the way you claim a domain name — fill out a form, provide a contact, and the number was yours. Many did exactly that for internal protocols or planned products that were eventually shelved, abandoned, or simply never deployed outside their origin organization.

Port 2785 appears to be one of these. The name "aic-np" suggests a naming or directory protocol in the AIC family of services. ONC-RPC (the basis for NFS and early Sun Microsystems protocols) was a common building block for distributed systems work in that era. But without documentation, it's speculation.

The number was reserved. The protocol, if it existed at all, never became public.

What You'll Actually Find on Port 2785

Nothing official. In practice, if something is listening on port 2785 on a system you administer, it's almost certainly a custom application, a game server, or development software that chose this port precisely because it's obscure and unoccupied.

To check what's using port 2785 on your system:

macOS / Linux:

# Show what process is listening on port 2785
sudo lsof -i :2785

# Or with ss (Linux):
ss -tlnp | grep 2785

Windows:

netstat -ano | findstr :2785

The PID from netstat can then be cross-referenced in Task Manager or with tasklist.

Why Unassigned and Ghost Ports Matter

The port space has 65,535 numbers. A few hundred host the protocols that run the Internet. A few thousand more are legitimately registered and actively used. The rest — including most of the registered range — are like port 2785: technically claimed, practically empty.

This matters for two reasons. First, security: an unexpected process listening on an obscure port is worth investigating. There is no legitimate "aic-np" software that should be running on your machine. Second, development: the obscurity of these ports makes them attractive choices for custom software. Developers reach for numbers like 2785 specifically because nothing well-known lives there.

If you see port 2785 in the wild, the question to ask isn't "what is aic-np?" It's "what chose to live here, and why?"