Port 2560: Labrat — A Name Without a Story

What Port 2560 Is

Port 2560 sits in the registered ports range (1024–49151). These ports are assigned by IANA to specific services through a formal request process — historically, on a first-come, first-served basis. ¹

IANA lists port 2560 as "labrat" on both TCP and UDP, attributed to a registrant named John Harvey. That entry is essentially everything that is publicly known about it. No RFC was ever written for it. No documentation exists explaining what the protocol does. No software package is widely known to use it. The name suggests a lab tool of some kind — an internal testing harness, maybe, or a network utility built for a specific environment that was registered but never published.

This is not unusual. Hundreds of ports in the registered range are exactly like this: claimed once, quietly, and then left. The registry is a graveyard of intentions that never shipped.

If You See Traffic on Port 2560

If something on your system is listening on port 2560, it almost certainly is not "labrat." It is more likely:

• A development server or local tool that happened to pick this port
• Custom application software configured to use it
• Malware (though this port is not specifically associated with known threats)

To find out what is using it:

Linux / macOS:

# Show which process is listening on port 2560
sudo ss -tlnp | grep 2560
# or
sudo lsof -i :2560

Windows:

# Show listening ports with process IDs
netstat -aon | findstr :2560
# Then look up the PID in Task Manager

Why Unassigned (and Ghost-Assigned) Ports Exist

The registered port space has over 48,000 slots. IANA has assigned maybe a few thousand of them to well-documented services. The rest are either officially unassigned or — like port 2560 — carry a name that no one has ever expanded into a real protocol.

This is a feature of how the Internet evolved, not a bug. Ports are cheap to register, expensive to actually standardize. Most software picks a port from the registered range, uses it, and never files the paperwork. Most registrations from the 1990s and early 2000s were made before anyone thought too carefully about whether the service would ever be documented for public use.

The result is a registry that is part address book, part archaeology site.