Port 2890: CSPCLMULTI — A Registered Ghost

What Port 2890 Is

Port 2890 sits in the registered ports range (1024–49151). These ports are assigned by IANA to specific services or applications, and vendors or developers can request registration to stake a claim on a port for their software.

Port 2890 is registered. Its IANA service name is CSPCLMULTI. It was registered by Yoneda Terumasa at PFU Co., Ltd., a Japanese IT company known for the ScanSnap document scanner line and the Happy Hacking Keyboard, and now a subsidiary of Ricoh.¹

That is the full extent of what the public record contains.

The Ghost Registration Problem

IANA's registry is not a living document — it's a ledger. Companies and developers register ports, and IANA records the name and contact. What IANA does not require is ongoing evidence that the protocol exists, ships, or works.

Port 2890 appears to be one of thousands of ghost registrations: a name (CSPCLMULTI), a contact email, and nothing else. No RFC defines the protocol. No public documentation explains what "CSPCLMULTI" stands for or what the service does. No open-source project, no Wireshark dissector, no forum post from a sysadmin says "I'm running CSPCLMULTI on port 2890."

The protocol may have been used internally at PFU, shipped in a product that's long discontinued, or simply never made it out of planning. There's no way to know from the outside.

What You'll Actually Find on Port 2890

If you see traffic on port 2890 in your environment, it is almost certainly not CSPCLMULTI. Port numbers in the registered range are frequently used informally by applications that never registered them, development servers, game clients, proxy tools, and peer-to-peer software. The registered name carries no enforcement.

How to Check What's Listening

To see if anything is using port 2890 on your machine:

macOS / Linux:

# Show process listening on port 2890
lsof -i :2890

# Or with ss (Linux):
ss -tlnp sport = :2890

Windows:

# Show connection and process ID
netstat -ano | findstr :2890

# Look up the PID in Task Manager, or:
Get-Process -Id (Get-NetTCPConnection -LocalPort 2890).OwningProcess

If nothing is listening, the port is dormant on your system — which is the expected state for the vast majority of registered ports at any given time.

Why Unassigned and Ghost Ports Matter

The registered port range contains 48,128 ports. Only a fraction are actively used by well-known services. The rest are a mix of: legitimate registrations for niche enterprise software, abandoned registrations from companies that no longer exist, ghost registrations like this one, and ports squatted by applications that never bothered to register.

This matters for two reasons. First, firewall rules that block "unknown" ports must be written carefully — a port being registered doesn't mean it's safe, and a port being unrecognized doesn't mean it's malicious. Second, when you see unexpected traffic on an unfamiliar port, the IANA registry is a starting point, not an answer. Port 2890 illustrates this perfectly: the registry says CSPCLMULTI, which tells you essentially nothing about what's actually running.