Port 2952: MPFWSAS — A Name Without a Story

What This Port Is

Port 2952 sits in the registered ports range (1024–49151). These ports are assigned by IANA — the organization that manages port numbers, IP addresses, and other Internet numbering resources — to specific services that have applied for a reservation.

This port is technically not unassigned. IANA lists it under the service name MPFWSAS, for both TCP and UDP.¹

The problem: that's all there is. No RFC. No linked documentation. No known software product, company, or protocol that uses this name. MPFWSAS appears to be a ghost registration — claimed at some point in the past, then abandoned without trace.

The Ghost Registration Problem

The IANA port registry has over 49,000 registered port slots. Filling one requires submitting an application, but the bar is low, and the registry has accumulated decades of registrations from companies, projects, and products that no longer exist — or perhaps never shipped.

Port 2952 appears to be one of these. The name MPFWSAS is an opaque acronym with no public documentation. No forum posts explain it. No packet captures mention it. If software ever used this port under that name, it left no record.

This matters because reserved-but-dormant ports create a kind of friction in the ecosystem. The slot is taken. If someone builds something real on port 2952, they're using an officially registered name that means nothing, while the actual reservation sits collecting dust.²

What Might Be Running on Port 2952

If you see traffic on port 2952 on your network, it is not coming from an official "MPFWSAS" service. More likely candidates:

• Custom or internal software that chose this port arbitrarily
• Game servers or game clients that use registered-range ports informally
• Malware — scanners flag this port occasionally as one observed in certain trojan activity, though this is not specific to port 2952³
• Dynamic or ephemeral use from an application that happened to bind here

How to Check What's Listening

On Linux or macOS:

# Show what process is listening on port 2952
ss -tlnp | grep 2952

# Or with lsof
lsof -i :2952

On Windows:

netstat -ano | findstr :2952

Then match the PID to a process:

tasklist | findstr <PID>

If something is listening on this port and you don't recognize the process, that's worth investigating.