Port 2716: Inova IP Disco — A Registered Port That Nobody Uses

Port 2716 is a registered port — which means IANA has a name in its registry for it. That name is Inova IP Disco, listed for both TCP and UDP. What Inova IP Disco does, who built it, and whether any software ever actually used it is largely a mystery. No RFC. No surviving documentation. Just an entry in a database.

This is more common than you might think.

The Registered Ports Range

Port 2716 sits in the registered ports range: 1024–49151. This is the middle tier of the port number space.

Registered ports are assigned on request. A company or developer submits an application to IANA, gets their name in the registry, and the port is "theirs" in a nominal sense. There's no enforcement. Nothing stops another application from using the same port, and nothing requires the registrant to actually ship software that uses it. Many registered ports are relics of products that never shipped, companies that no longer exist, or protocols that were superseded before anyone adopted them.

Inova IP Disco appears to be one of these. The registration exists. The product, if it ever ran anywhere, left no detectable footprint.¹

The Prayer

Port 2716 shows up more consistently in a different kind of database: malware records.

A backdoor trojan called The Prayer (versions 1.2, 1.3, and 2) used port 2716 as its command-and-control channel. Once installed on a Windows machine, it opened this port and waited — silently — for a remote attacker to connect. The attacker could then execute commands, browse the filesystem, and exfiltrate data.²

The Prayer is old. The variants documented against port 2716 circulated in the early 2000s and modern antivirus handles them trivially. But the port number stuck in firewall block lists and security databases, which is why you'll find 2716 flagged as "suspicious" in some older security tooling.

An old trojan association doesn't make the port dangerous today. It means you should know what's using it if you see traffic on it.

What to Check if You See Traffic on 2716

If port 2716 shows up in your monitoring, it's almost certainly something you put there — a custom application, development server, or misconfigured service. Here's how to check:

On Linux/macOS:

# Show what process is listening on port 2716
sudo ss -tlnp | grep 2716

# Or with lsof
sudo lsof -i :2716

On Windows:

netstat -ano | findstr :2716

The PID in the output maps to a process in Task Manager or tasklist. If the process is unfamiliar, investigate before assuming it's benign.

Why Unassigned (and Ghost-Assigned) Ports Matter

The port number space isn't a clean map. It's a historical record — of services that were built, companies that registered names they never used, protocols that won and lost, and malware that squatted on whatever number was convenient.

Understanding the registered range means understanding that a name in the IANA registry is a claim, not a guarantee. Real port meaning comes from actual network traffic, not database entries.

Port 2716 is registered to something nobody can find. That's worth knowing when you're interpreting port scan results or writing firewall rules.