Port 2385: SD-DATA — A Name Without a Story

What This Port Is

Port 2385 sits in the registered port range (1024–49151), the middle tier of the port numbering system. These ports are claimed through IANA by developers and organizations for their specific applications. They're not reserved for system services like the well-known ports below 1024, but they're not thrown open to chance like the ephemeral ports above 49151 either.

According to the IANA Service Name and Transport Protocol Port Number Registry, port 2385 is assigned to a service called SD-DATA — on both TCP and UDP — registered to someone named Jason McManus.¹

That's roughly where the paper trail ends.

There's no RFC. No publicly documented specification. No product documentation that references this port by name. SD-DATA appears in the IANA registry the way a name appears on a lease that was never renewed — technically present, practically invisible.

This isn't unusual. The registered port range contains hundreds of assignments that were claimed, perhaps used in some internal or proprietary system, and then quietly forgotten. The Internet moved on. The registry didn't.

The 2300–2400 Neighborhood

Port 2385 shares a neighborhood with a specific piece of history. The range 2300–2400 was heavily used by DirectX 7-era games in the late 1990s and early 2000s — Age of Empires II, Flight Simulator 2000, Stronghold Crusader, Total Annihilation, MSN Game Zone.² These games used UDP across this range for real-time multiplayer traffic, where speed mattered more than guaranteed delivery.

Those games are mostly gone from active play, and their network traffic with them. But the port numbers they used still show up in old firewall rules, network documentation, and the occasional nostalgic LAN party.

What's Actually Listening?

If you see traffic on port 2385 today, it's almost certainly not SD-DATA — whatever that was. It could be:

• A custom application that chose this port arbitrarily
• Malware or a scanner probing for open services (SANS ISC records regular scanning activity on this port)³
• Something your OS assigned as an ephemeral source port and immediately freed

To see what, if anything, is listening on port 2385 on your system:

Linux / macOS:

ss -tlnp | grep 2385
# or
lsof -i :2385

Windows:

netstat -ano | findstr :2385

If nothing comes back, nothing is listening. That's the expected result for almost every machine on the Internet.

Why Unassigned-in-Practice Ports Matter

The registered port range was supposed to be an organized namespace. In practice, it's a graveyard of good intentions. Assignments get made for products that ship once, get acquired, or never launch. The registry rarely reclaims them.

This matters because every obscure, dormant assignment is a potential source of confusion — for network administrators writing firewall rules, for security tools that flag "unknown" traffic, and for anyone trying to understand what's happening on their network.

Port 2385 won't cause you trouble. But it's a small illustration of how the port system works in practice: the registry is a historical record as much as an active directory.