Port 2492: Groove — The Collaboration Tool That Became a Ghost

What Port 2492 Is

Port 2492 is officially assigned to Groove on both TCP and UDP, registered with IANA by Ray Ozzie — the same engineer who created Lotus Notes.¹ Today the software that claimed this port is discontinued, making 2492 one of the registry's many historical markers: officially occupied, practically unused.

The Groove Story

In 1997, after IBM acquired Lotus for $3.5 billion, Ray Ozzie left and started over. Watching his son play Quake with friends across the Internet gave him an idea: what if you could build a shared workspace the same way — peer-to-peer, no central server, just people directly connected to people?

Three years of stealth development later, Groove Networks launched in 2000. The platform let users create encrypted shared spaces for documents, discussions, and real-time collaboration. Everything lived on participants' local machines and synchronized directly between them. No server in the middle. All traffic encrypted. Port 2492 was how Groove peers found and talked to each other.²

It was genuinely ahead of its time — a distributed, encrypted collaboration tool years before Slack, Dropbox, or Teams existed.

What Happened to It

Microsoft acquired Groove Networks in March 2005 for approximately $120 million and brought Ray Ozzie along as Chief Technical Officer, eventually naming him Chief Software Architect after Bill Gates stepped back.³ Groove became Microsoft Office Groove 2007, then Microsoft SharePoint Workspace 2010, then was discontinued. Its ideas about real-time sync and offline-first collaboration quietly migrated into OneDrive and Microsoft 365.

Port 2492 was left behind.

The Registered Port Range

Port 2492 sits in the registered ports range (1024–49151). These ports are assigned by IANA to specific services but are not protected the way well-known ports (0–1023) are — any process on any machine can bind to them. The registration is a directory entry, not a lock.⁴

For active services, the registered range is the right place to be: it signals intent, avoids collisions with common software, and documents who owns what. For defunct services like Groove, the registration just persists, unclaimed in practice but technically occupied.

Is Anyone Using This Port Today?

Almost certainly not for Groove — the software has been unsupported for over a decade. If you see traffic on port 2492, it's either:

• Legacy Groove or SharePoint Workspace installations (increasingly rare)
• Software that happened to pick this port informally
• A security scanner probing for open ports

How to Check What's Listening

To see if anything on your machine is bound to port 2492:

macOS / Linux:

lsof -i :2492

Windows:

netstat -ano | findstr :2492

If nothing appears, the port is closed. If something does, the process ID in the output will tell you what claimed it.