Port 2111: DSATP — A Port That Outlived Its Owner

Port 2111 is registered in the IANA registry as dsatp — the OPNET Dynamic Sampling Agent Transaction Protocol. OPNET Technologies registered it on September 21, 2011.¹ One year later, Riverbed Technology acquired OPNET for approximately $1 billion.²

The port is still registered to OPNET. The company no longer exists.

What DSATP Does

OPNET built software for network simulation and performance analysis. Their Dynamic Sampling Agent Transaction Protocol was used by monitoring agents to communicate measurements and telemetry back to a central management platform — the kind of internal housekeeping traffic that enterprise network monitoring tools generate constantly but that nobody outside the vendor ever thinks about.

If you're running OPNET IT Guru or the monitoring components of what is now called Riverbed Modeler or SteelCentral, port 2111 is where your agents report in. For everyone else, this port is silent.³

What Range This Port Lives In

Port 2111 sits in the registered ports range (1024–49151). This is the middle tier of the port numbering system:

• Well-known ports (0–1023): Reserved for foundational protocols — HTTP, HTTPS, SSH, DNS. You need root/administrator privileges to listen on these.
• Registered ports (1024–49151): Companies and developers register these with IANA for specific applications. No special privileges required to use them.
• Dynamic/ephemeral ports (49152–65535): Temporarily assigned by the operating system for outbound connections. Not registered for specific services.

Registered doesn't mean common. The IANA registry contains thousands of ports assigned to proprietary protocols, internal tools, and products that never achieved widespread adoption. Port 2111 is one of them.

Security Notes

Port 2111 has appeared in malware databases — specifically, Backdoor.Win32.Delf.abb has been observed listening on this port. Unrecognized traffic on port 2111 on a system with no OPNET installation warrants investigation.⁴

How to Check What's Listening on Port 2111

If you see activity on port 2111 and want to know what's behind it:

Linux/macOS:

# Show which process is listening on port 2111
sudo ss -tlnp | grep 2111

# Or with lsof
sudo lsof -i :2111

Windows:

netstat -ano | findstr :2111

Then look up the process ID (PID) in Task Manager to identify the application.

If nothing is listening on port 2111, you're not running OPNET infrastructure. That's the expected state for the vast majority of networks.

Why Unassigned-Looking Ports Matter

Port 2111 isn't truly unassigned — it just belongs to something obscure. The difference matters.

A port that's actually unregistered means any application can claim it without coordination. When two applications independently decide to use the same unregistered port, you get conflicts. The IANA registration system exists to prevent this: one entity gets one assignment, creating a record of intent even if the product eventually fades.

Port 2111's registration is a fossil. It preserves the moment OPNET Technologies decided this number would be theirs — just before everything changed.