Port 2446: bues-service — A Name Without a Story

What Port 2446 Is

Port 2446 sits in the registered port range (1024–49151). These are ports that organizations and individuals can claim with IANA to reserve for a specific service, preventing collisions with other protocols.

Someone did exactly that. According to the IANA registry, port 2446 is assigned to bues-service, registered by Leonhard Diekmann. It is assigned on both TCP and UDP.¹

The IANA description for this port reads: bues_service.

That's the whole entry. The description is the name. There is no RFC, no specification, no public documentation explaining what "bues-service" actually does or did.

What We Can Infer

The registrant's name connects to bues.ch, a site maintained by a developer who publishes security and networking tools. One such tool — letmein, an authenticated port knocker — is publicly documented but uses a different port entirely (TCP 5800 by default).²

Whether bues-service was an internal project that never shipped, a placeholder registration, or something that simply never found public adoption, the record doesn't say. No widely-deployed software is known to use port 2446.

How to Check What's Listening on This Port

If you see port 2446 active on a system you're responsible for, standard tools will tell you what's behind it:

Linux / macOS:

# Show what process is listening on port 2446
ss -tlnp sport = :2446

# Or with lsof:
lsof -i :2446

Windows:

netstat -ano | findstr :2446

The PID in the output maps to a process in Task Manager or via tasklist /FI "PID eq <pid>".

Why Registered-but-Dormant Ports Exist

The registered port range has over 48,000 slots. IANA assigns them on request, and the bar for registration is low — you submit a form, describe an intent, and a port is yours. Many registered ports represent services that were planned but never widely deployed, internal systems that never needed public exposure, or projects that were eventually abandoned.

Port 2446 is one of many. The registration prevents another service from officially claiming the number, but it doesn't guarantee anything is actually listening there on any given machine.

If you find this port open somewhere unexpected, the registered name tells you very little. Investigate the process directly.