Port 2391: 3COM Net Management — A Ghost in the Registry

What Port 2391 Is

Port 2391 sits in the registered ports range (1024–49151), which means someone formally claimed it with IANA. That someone was 3COM Corporation, who registered it under the service name 3com-net-mgmt — "3COM Net Management."

The assignment covers both TCP and UDP.

That's roughly where the paper trail ends.

The 3COM Story

3COM was once a major force in networking. Founded in 1979 by Bob Metcalfe (one of the inventors of Ethernet), the company made routers, switches, network interface cards, and the Palm Pilot. At their peak in the late 1990s, they competed directly with Cisco for enterprise networking dominance.

Port 2391 was registered during 3COM's operational years as part of their network device management infrastructure — the communication channel between management software and 3COM switches or routers. The exact protocol behavior, handshake sequence, and wire format were never publicly documented in an RFC or technical specification that survived to the present.

HP acquired 3COM in 2010 for $2.7 billion.¹ The 3COM brand was gradually retired. Whatever internal documentation existed for 3com-net-mgmt appears to have gone with it.

IANA's registry still shows the assignment, with a contact email for a 3COM engineer who presumably moved on long ago.²

Who Actually Uses This Port Today

Almost no one, intentionally. Modern HP/Aruba and HPE networking products use different management channels (SNMP on 161/162, HTTPS on 443, SSH on 22). There is no known active software that opens port 2391 by design.

Some security scanners and port databases have flagged 2391 as historically associated with malicious traffic — meaning at some point, malware authors used this obscure registered-but-forgotten port as a communication channel, betting that security teams wouldn't scrutinize it. This is a common pattern: abandoned registered ports make convenient hiding spots precisely because they're not well-known enough to be immediately suspicious.³

If you see port 2391 open on a modern system, the most likely explanations are:

• An application chose it arbitrarily for internal communication
• Malware is using it as a C2 channel
• Something legacy is running that you've forgotten about

None of these involve actual 3COM network management.

How to Check What's Listening

macOS / Linux:

lsof -i :2391

Linux alternative:

ss -tlnp sport = :2391

Windows:

netstat -aon | findstr :2391

The process ID in the output lets you look up what's actually running. On Windows, cross-reference the PID in Task Manager. On Linux/macOS, lsof shows the process name directly.

If something unexpected is listening, that's worth investigating.

Why Ghost Assignments Matter

The registered ports range was designed to give organizations stable, predictable addresses for their services. It works reasonably well for active protocols with living maintainers.

But registered ports don't expire. 3COM registered 2391 and it stays registered — indefinitely — even though the company is gone, the protocol is undocumented, and no software uses it. IANA's registry has thousands of entries like this: ports claimed during networking's formative decades by companies that merged, failed, or pivoted.

The result is a registry that's simultaneously authoritative and full of dead entries — a museum of networking history where every exhibit says "assigned" but many exhibits have lost their labels.