Port 2413: Orion RMI Registry — A Registered Port for a Forgotten Server

What Port 2413 Is

Port 2413 is registered with IANA as orion-rmi-reg — the RMI (Remote Method Invocation) registry port for the Orion Application Server. It sits in the registered port range (1024–49151), meaning it has an official IANA assignment, but the software it was assigned for has been effectively extinct for over a decade.

If you see traffic on port 2413 today, it almost certainly isn't Orion.

The Orion Application Server

Orion was a Java EE application server built by a Swedish company called IronFlare AB, first released in 1999. At the time it mattered: Orion claimed to be one of the first application servers with full J2EE compliance, and it had a reputation for being fast and lightweight compared to heavier alternatives.

Oracle licensed the technology and used it as the foundation for OC4J — Oracle Containers for J2EE. Port 2413 was registered for Orion's RMI registry: the lookup service that let Java clients find and connect to distributed objects running inside the server. Standard Java RMI uses port 1099 for its registry; Orion needed its own.

Oracle eventually deprecated OC4J in favor of WebLogic, and IronFlare's Orion server quietly faded from use. The IANA registration for port 2413 remains, but it's a headstone more than an active reservation.¹

The Registered Port Range

Port 2413 lives in the registered port range (1024–49151), also called the "user ports" range. These ports:

• Require IANA registration to claim officially
• Can be used by any process on most operating systems (no root/admin required)
• Are not reserved at the OS level — any application can bind to them

Unlike well-known ports (0–1023), registered ports aren't locked down. The assignment is a convention, not enforcement. Nothing stops another application from binding to 2413 on your machine.²

What's Likely Listening on Port 2413 Today

Almost certainly not Orion. If you find port 2413 open, it's probably:

• A development server, proxy, or custom application that chose this port arbitrarily
• A misconfigured or legacy Java application with OC4J lineage
• Scanning noise or a probe from the outside

How to Check What's Using Port 2413

Linux / macOS:

# Show what process is listening on port 2413
ss -tlnp | grep 2413

# Or with lsof
lsof -i :2413

Windows:

netstat -ano | findstr :2413

The PID in the output maps to a process you can look up in Task Manager or with tasklist.

Why Unassigned-ish Ports Still Matter

Port 2413 illustrates something real about how the port namespace works. IANA registrations don't expire. Technology comes and goes, but the registry entries persist. There are hundreds of ports like this — registered for enterprise software from the late 1990s and early 2000s, still technically "taken" on paper, now functionally available.

This matters for two reasons. Firewall rules written against "registered" ports to block unknown services can give a false sense of security — the registered name tells you nothing about what's actually bound. And developers choosing ports for new software sometimes pick from "gaps" in the registry, not realizing those gaps have quiet occupants.

The registered port range is partly a historical record of what people built, not just a directory of what's running.