Port 2707: EMC Symapi — A registered port with an uninvited squatter

What Port 2707 Is

Port 2707 sits in the registered port range (1024–49151). These ports are assigned by IANA to specific services, though no one enforces that assignment. Any application can open any port. IANA's registry is a map, not a law.

IANA lists port 2707 as EMCSYMAPIPORT — the EMC Symmetrix API port, used by Dell EMC storage management software. Specifically, products like EMC VSI for VMware vSphere use it to communicate with the SYMAPI (Symmetrix Application Programming Interface), which manages enterprise storage arrays. If you're running a Dell EMC storage environment with VMware integration, this port is legitimate and expected.

If you're not running Dell EMC storage software, it shouldn't be open.

The Squatter: Backdoor.Bigfoot

Port 2707 carries a second entry in the security databases: Backdoor.Bigfoot, a remote-access trojan that opens this port as a listening socket, allowing an attacker to remotely control an infected machine.

Why this port? Partly because it was registered but obscure. A port with an official-sounding name in the registered range looks less suspicious than a random high port. It's the malware equivalent of wearing a name badge.

The trojan is old and not widely active today, but port scanners and security tools still flag 2707 as a port worth inspecting when found open unexpectedly.¹

What Range This Port Belongs To

Registered ports are assigned by IANA upon request. Any vendor can apply to reserve a port for their service. The assignments are public, but compliance is voluntary. This is why the same port can appear in both a legitimate enterprise product and a trojan's configuration.

Checking What's on This Port

To see if anything is listening on port 2707 on your system:

macOS / Linux:

lsof -i :2707

Windows:

netstat -ano | findstr :2707

If a process appears, check its name. On a machine running Dell EMC storage management tools, a process from that suite is expected. On anything else, investigate.

To check from the network side with nmap:

nmap -p 2707 -sV <host>

The -sV flag attempts to identify the service, which can help distinguish legitimate storage software from something less welcome.

Why Unassigned-Looking Ports Matter

Port 2707 is technically assigned, but its service is enterprise-specific and rarely encountered outside large storage environments. This makes it effectively invisible to most administrators — and that's exactly the kind of port worth knowing about.

The registered port range has over 48,000 slots. Most are legitimately assigned. Some are squatted by malware. A few are assigned to services that no longer exist. Understanding which category a port falls into is the difference between a false alarm and a missed intrusion.