Port 2004: Unassigned — a ghost name and an open door

What Range This Port Belongs To

Port 2004 falls in the registered port range (1024–49151). These ports are managed by IANA and are intended to be assigned to specific services upon application. Unlike the well-known ports (0–1023), they don't require root or administrator privileges to bind on most operating systems.

"Registered" doesn't mean occupied. IANA's registry is large, historical, and full of entries that were claimed and then abandoned. Port 2004 is one of them.

The Ghost in the Registry

IANA's records list port 2004 TCP as "mailbox" — a name that appears in RFC 1340, the 1992 Assigned Numbers document. There is no protocol specification behind that name. No RFC defines a "mailbox" service on port 2004. No software was ever widely deployed to use it. The name is a fossil — assigned in an era when port squatting was done optimistically, before anyone had to prove they were building something.

On UDP, IANA lists port 2004 as "emce" (associated with CCWS multimedia conferencing). This too has no surviving implementation of note.

In practice: this port is unassigned in any meaningful sense.

Security History

Precisely because port 2004 has no legitimate owner, it has attracted illegitimate ones.

Trojans: The port has been historically associated with the Duddie and TransScout backdoors — remote access trojans that used obscure, unclaimed ports to avoid firewall rules written for known services.¹

CVE-2025-69425: In 2025, Ruckus vRIoT IoT Controller firmware (versions before 3.0.0.0) was found running a command execution service on TCP port 2004 — with root privileges and hardcoded credentials.² Any device on the network could connect, authenticate with the baked-in password, and execute arbitrary commands as root.

That vulnerability illustrates the pattern: a developer needed a port for an internal service, picked one that seemed unused, never locked it down, and shipped it. The port's anonymity felt like security. It wasn't.

How to Check What's Listening on This Port

If you see port 2004 open on a system, find out why before assuming it's benign.

Linux/macOS:

# Show what process is listening on port 2004
sudo ss -tlnp | grep 2004

# Or with lsof
sudo lsof -i :2004

Windows:

netstat -aon | findstr :2004

Then take the process ID from the output and look it up:

# Linux: get the process name
ps -p <PID> -o comm=

# Windows: get the process name
tasklist /FI "PID eq <PID>"

If you don't recognize the process, investigate. Open ports on unassigned numbers are not self-explanatory — they require justification.

Why Unassigned Ports Matter

The registered port range has roughly 48,000 slots. Many are assigned; many more are not. Unassigned ports aren't neutral — they're a resource that software regularly claims at runtime, intentionally or accidentally.

This matters for three reasons:

Firewall rules need specifics. A rule that blocks all traffic except known-good ports will block port 2004 by default. A rule that allows everything except known-bad ports will let it through. Which approach you take has consequences.

Malware prefers obscurity. Backdoors and command-and-control channels favor ports that don't appear in standard firewall blocklists. An unassigned port in the registered range is a lower-profile choice than port 80 or 443, which trigger scrutiny.

Legitimate software claims ports informally. Applications that need an internal communication channel often pick a port from the registered range without going through IANA. This is common and usually harmless — until two applications pick the same port, or until a security audit asks "why is this port open?"

Port 2004 has no service. If it's open on your network, someone put it there. The question worth asking is who.