Port 2627: Webster — the Dictionary Before DICT

What Port 2627 Is

Port 2627 is a registered port — meaning it sits in the range from 1024 to 49151, the space where applications and services register names with IANA to stake their claim. Unlike well-known ports (0–1023), registered ports don't require elevated privileges to open, and their assignments are looser, more historical.

This particular port was registered for the Webster network dictionary protocol. It's not widely active today, but it has a story worth knowing.

The Webster Protocol

Before the web, before search engines, before you could just type a word into a browser and get a definition, there were Webster servers. These were Unix machines running dictionary software that accepted network queries and returned definitions over TCP.

The protocol was simple to the point of being primitive: connect, send a word, get a definition back, disconnect. It worked against a single dictionary — typically Merriam-Webster's — and optionally a thesaurus. No multi-database support, no standardized command set, no formal specification. It just worked, and people used it.

Webster servers listened on port 2627.

Why Port 2628 Exists

By the mid-1990s, freely distributable dictionary databases were accumulating — WordNet, the Jargon File, FOLDOC, translation dictionaries. The Webster protocol couldn't handle them. It was designed for one dictionary, and the Internet now had dozens worth serving.

In 1997, Rickard E. Faith and Bret Martin wrote RFC 2229: the Dictionary Server Protocol, better known as DICT. It introduced a proper command set (DEFINE, MATCH, SHOW DATABASES), UTF-8 support, and a clean way to serve many dictionaries at once.

DICT listened on port 2628 — one port up from Webster. The RFC authors explicitly noted that "webster servers typically listened on port 2627." They knew exactly what they were replacing.

Port 2627 didn't disappear. It just got quieter.

Security Note

Backdoor.Rallovs.B, a trojan documented by Symantec in 2012, opened a backdoor on TCP port 2627 on compromised machines. Malware authors often choose registered-but-dormant ports precisely because they're unlikely to conflict with active services.

If port 2627 appears open on a system that isn't running a Webster dictionary server — and essentially no system is, in 2025 — it warrants investigation. ¹

How to Check What's Listening

# macOS / Linux
sudo lsof -i :2627

# Linux (alternative)
ss -tlnp | grep 2627

# Windows
netstat -ano | findstr :2627

The lsof output will show you the process name and PID. If nothing appears, the port isn't in use.

The Registered Port Range

Port 2627 sits in the registered ports range (1024–49151). IANA maintains a registry of assignments in this range, but the rules are less strict than for well-known ports. Services register, time passes, services go dark, and the port number stays in the registry — a placeholder for something that once mattered.

The range exists to give applications a stable address without requiring root access. When you run a web server on port 8080 instead of 80, you're using registered port territory. The space is large enough that conflicts are rare, small enough that the registry has meaning.

Port 2627 is registered. Webster is gone. DICT is still running somewhere, one port up, carrying on.

Related Ports