Port 2645: Novell IPX CMD — A Reserved Port from a Quieter Era

What This Port Is

Port 2645 is registered with IANA under the service name novell-ipx-cmd — a command channel for Novell's IPX (Internetwork Packet Exchange) networking stack.¹ It runs on both TCP and UDP.

You won't encounter it doing real work on modern networks. It belongs to an era that largely closed when TCP/IP became the universal language of networking and Novell NetWare lost the enterprise market in the late 1990s.

What IPX Was

Before TCP/IP dominated everything, Novell's IPX/SPX protocol suite powered a significant share of corporate networks. NetWare servers used IPX to handle file sharing, printing, and directory services — the critical infrastructure of office computing throughout the 1980s and early 1990s.

IPX didn't need configuration in the way IP does. It was plug-and-play before that phrase existed. But it was also proprietary, didn't route well across wide-area networks, and couldn't adapt to the Internet's growth. When TCP/IP became mandatory, IPX became optional. Then it became irrelevant.

Port 2645 was registered as part of that IPX ecosystem. The registration contact at IANA is Juan Carlos Luciani of Novell — a name from a company that itself no longer exists in its original form.

What Range This Port Belongs To

Port 2645 sits in the registered port range (1024–49151), sometimes called user ports. These ports are:

• Not reserved for system processes (that's 0–1023)
• Formally registered with IANA for specific applications
• Usable by ordinary applications without elevated privileges

The registered range exists so that well-known software can claim a consistent port number — a stable address the world can count on. Port 2645's registration is legitimate, just dormant.

What You'll Find Here Today

Almost nothing intended. If you see activity on port 2645, it's likely:

• Scanner noise — automated tools probing registered ports
• Malware or botnet traffic using obscure ports to avoid detection
• Misconfigured legacy software running older Novell components
• False positives from port scanners that match port numbers to service names

Genuine Novell IPX CMD traffic in a modern network would be genuinely surprising.

How to Check What's Listening

If you see port 2645 active on your machine:

Linux/macOS:

ss -tlnp | grep 2645
# or
lsof -i :2645

Windows:

netstat -ano | findstr :2645
# Then match the PID:
Get-Process -Id <PID>

If something is listening, investigate the process. There's no legitimate modern software that needs this port.