Port 2655: Unglue — A Ghost Registration from the Unix/NT Wars

What This Port Is

Port 2655 sits in the registered port range (1024–49151), the middle tier of the port number system. IANA maintains this range for services that have formally requested a number — software vendors, protocol authors, and developers who filed the paperwork.

Unlike the well-known ports below 1024 (HTTP on 80, SSH on 22), registered ports don't require elevated privileges to open. Any process on a system can listen on port 2655 without being root.

The Registered Service: Unglue

IANA records port 2655 as assigned to a service named unglue, described as "UNIX Nt Glue" — on both TCP and UDP.¹

The name tells the story of its era. The late 1990s were a battlefield between Unix workstations and Windows NT servers. Enterprises ran both, and making them cooperate required considerable effort. A whole industry of "glue" software emerged — tools that let Unix machines authenticate against NT domains, share filesystems across the divide, and synchronize users between fundamentally incompatible worlds.

"UNIX NT Glue" was one such solution. It was registered with IANA, which means at some point someone formally submitted a port request. But the software never became widely adopted, left no lasting documentation, and has no traceable presence today. The registration outlived the product by decades.

What's Actually on This Port

Almost certainly nothing related to the original service. If port 2655 is open on a machine you're examining, it's almost certainly something else entirely — a custom application, a game server, a development service, or a misconfiguration.

Port registrations don't expire. A number claimed in 1998 for defunct software stays claimed on paper forever, which is part of why the registered range is full of ghost names.

How to Check What's Listening

On Linux or macOS:

# Show what process holds port 2655
ss -tlnp | grep 2655

# Or with lsof
lsof -i :2655

On Windows:

netstat -ano | findstr :2655

Then cross-reference the PID with Task Manager or tasklist to identify the process.

From outside the machine (network scan):

nmap -sV -p 2655 <target-ip>

The -sV flag attempts to fingerprint whatever is actually running, regardless of what IANA says the port is "supposed" to be.

Why Ghost Registrations Exist

The IANA registration process in the 1990s and early 2000s had low friction. You submitted a form. You got a number. There was no requirement to prove the software existed, was maintained, or was ever deployed at scale.

The result is a registry full of names like "unglue" — real registrations for real software that real companies once built, now orphaned. They're not malicious. They're archaeological.

If you see port 2655 open in the wild, treat it as unidentified until you verify what's actually running. The IANA label tells you almost nothing useful in 2025.