Port 2984: hpidsadmin — The Intrusion Watcher's Door

What This Port Does

Port 2984 is registered with IANA as hpidsadmin: the administrative interface for HP-UX's Host Intrusion Detection System (HIDS).¹

It works as a pair with port 2985 (hpidsagent):

• Port 2984 (hpidsadmin): The management plane. Administrators connected here to configure, monitor, and control the intrusion detection system.
• Port 2985 (hpidsagent): The agent side. The software actually watching the system for intrusions reported through here.

Both ports support TCP and UDP.

What HP-UX HIDS Was

HP-UX is Hewlett-Packard's proprietary Unix operating system, built for its PA-RISC and later Itanium server hardware. In the era when HP-UX ran serious enterprise workloads — banks, telecoms, government systems — HP shipped a Host Intrusion Detection System as a security component.²

HIDS software watches what happens on a machine itself: file changes, process behavior, login patterns, system calls. If something looks like an attacker moving through the system, HIDS raises an alarm. The admin interface on port 2984 is where you went to see what it found.

HP-UX HIDS is effectively end-of-life. The hardware it ran on has largely been retired. You won't find port 2984 active on modern infrastructure unless someone is running very old HP-UX servers.

The Registered Port Range

Port 2984 sits in the registered ports range (1024–49151).³ This range is where IANA records port assignments for specific applications and services. Unlike the well-known ports below 1024 (which require root privileges to open), registered ports are used by ordinary applications and services that have formally requested an assignment.

Registration means the port is documented and recognized. It does not mean the port is commonly in use — and in this case, it almost certainly isn't.

How to Check What's Using This Port

If you see traffic on port 2984 and want to know what's behind it:

On Linux or macOS:

# See what process is listening on port 2984
sudo lsof -i :2984

# Or with ss (Linux):
sudo ss -tlnp sport = :2984

On Windows:

netstat -ano | findstr :2984

The process ID in the output can be cross-referenced against your process list. On a modern system, finding anything on port 2984 would be unexpected. If you do, it's worth investigating.

Why Unoccupied Registered Ports Matter

The port registry has over 48,000 slots in the registered range, and many of them are assigned to software that's been abandoned, renamed, or forgotten. Port 2984 is one of these. Its registration exists in perpetuity even though the software that claimed it has largely vanished from production.

This matters for two reasons. First, port scanners may flag registered ports as suspicious if something unexpected is listening there — the registration creates a baseline expectation of what should be there. Second, software developers choosing a port for a new application will (ideally) consult the registry to avoid collisions with registered assignments like this one.

The port namespace is finite. Every tombstone registration like port 2984 is a slot that won't be reassigned even as the software it represents becomes history.