Port 2543: REFTEK RTP — The Earthquake Port

Port 2543 sits in the registered port range (1024–49151) and carries an unusual kind of traffic: seismic data from earthquake sensors deployed on fault lines, volcanoes, and ocean floors around the world.

What the Registered Range Means

The Internet Assigned Numbers Authority (IANA) divides the 65,535 available port numbers into three bands:

• Well-known ports (0–1023): Reserved for major protocols — HTTP, HTTPS, SSH, DNS. Requires elevated system privileges to open.
• Registered ports (1024–49151): Any organization can apply to register a service here. No privilege required to open. IANA keeps a list, but enforcement is loose — the same port can have multiple claimants, and many registered ports go unused for years.
• Dynamic/ephemeral ports (49152–65535): Assigned temporarily by the OS to outbound connections. Not registered to anything.

Port 2543 is registered territory, which means nothing is guaranteed to be there — but something interesting often is.

What Actually Runs Here

REF TEK Systems is a company that builds high-resolution seismic recorders used by universities, national geological surveys, and earthquake monitoring networks. Their instruments — deployed in remote locations, often with constrained connectivity — need to transmit waveform data back to central servers continuously and reliably.

Their solution is the REF TEK Protocol (RTP), a lightweight binary protocol that uses port 2543 over UDP. The design is deliberately inverted from the typical client-server model: the field instrument initiates the connection outbound, pushing data to the server. This means it works behind firewalls and NAT without requiring port forwarding, static IPs, or VPN tunnels — which matters when your sensor is on a volcano accessible only by helicopter.

RTP includes two daemon components:

• RTPD: Sits and listens for incoming seismic data packets
• RTPID: Watches RTPD and restarts it if the data flow stops

Port 2543 is registered with IANA for this use under both TCP and UDP.¹

Checking What's Listening on This Port

If you see port 2543 active on a machine that isn't part of a seismological network, it's worth investigating:

macOS / Linux:

# Show what process owns port 2543
sudo lsof -i :2543

# Or with ss (Linux):
sudo ss -tulpn | grep 2543

Windows:

netstat -aon | findstr :2543

The process ID in the output can be matched against the running process list (tasklist on Windows, ps aux on Linux/macOS) to identify the owner.

Why Unassigned Gaps Matter

IANA's registry has thousands of ports in the registered range with no official assignment. This isn't chaos — it's headroom. Applications, games, enterprise software, and protocols like REFTEK's claim ports informally, by convention, or through IANA registration. The system works because the registry makes those conventions visible and the port space is large enough that collisions are rare.

When you open a port on a firewall or see an unexpected connection, the IANA registry is the first place to check — but it won't always have the answer. Port 2543 is a good example: officially listed, genuinely used, and carrying data that most people would never associate with a number they'd never think to look up.