Port 2421: G-Talk — Registered, Forgotten

What Port 2421 Is

Port 2421 is a registered port — the middle tier of the three-range port system.

The Internet's 65,535 ports are divided into three bands:

• Well-known ports (0–1023): Reserved for core protocols. HTTP, SSH, DNS. These require elevated privileges to open on most systems.
• Registered ports (1024–49151): Anyone can apply to IANA to reserve a port for their application. No elevated privileges required to listen. This is where port 2421 lives.
• Dynamic/ephemeral ports (49152–65535): Unregistered, assigned temporarily by the OS for outbound connections. Here today, gone in microseconds.

Being in the registered range means port 2421 is intended for a named service — not random system traffic, not ephemeral connections. It's supposed to belong to something.

The Registered Service: G-Talk

According to the IANA Service Name and Transport Protocol Port Number Registry, port 2421 is assigned to g-talk on both TCP and UDP. The registrant contact is listed as Matt Hammond at four-sight.co.uk.

That's the entirety of what's publicly known.

"G-talk" doesn't correspond to any widely deployed software, open standard, or documented protocol. It's not Google Talk (which used entirely different ports). It's not any messaging protocol with a public specification. It's a name in a registry, attached to an email address, pointing to a company that appears to no longer operate.

This is not unusual. The registered ports range is littered with entries like this — protocols that were reserved before software shipped, projects that stalled, companies that folded. IANA doesn't reclaim ports aggressively. Once assigned, a port tends to stay assigned indefinitely, even when the assignee has vanished.

What You'll Actually Find on This Port

Almost certainly nothing. If you scan a random host on port 2421, you'll find it closed. If something is listening on it, it's not g-talk — it's whatever the operator of that machine decided to put there.

That's the practical reality of ghost ports: the official assignment carries no enforcement weight. Any software can listen on any registered port. Port 2421 is as available as any unassigned port, because its nominal owner never built anything that uses it.

Occasionally, security researchers have flagged port 2421 as one that appeared in older trojan or remote access tool activity — the kind of software that deliberately picks obscure registered ports to blend in. This isn't specific to port 2421; any rarely-used registered port can serve as camouflage.

How to Check What's Listening

If you see traffic on port 2421 and want to know what it is:

On Linux/macOS:

# Show processes listening on port 2421
sudo ss -tlnp sport = :2421

# Or with lsof
sudo lsof -i :2421

On Windows:

# Show listening ports with process IDs
netstat -ano | findstr :2421

# Map PID to process name
tasklist | findstr <PID>

For network-level inspection:

# Check if a remote host has anything listening
nmap -p 2421 <host>

# With service detection
nmap -sV -p 2421 <host>

Why Ghost Ports Matter

The IANA registry assigns names to ports so that software can coexist without collision. The idea is that if g-talk claims 2421, nothing else should use it — reducing the chance that two different services step on each other.

In practice, for obscure registered ports like this one, the registry provides minimal real-world protection. Developers pick ports based on availability at the time, convention, or configuration. If a service needs a non-standard port and 2421 is free in practice, they'll use it regardless of what the IANA list says.

The registry's value is strongest at the well-known ports (0–1023), where the assignments reflect protocols that billions of devices actually implement. For the registered range, it's more like a naming database than a traffic cop — useful when people check it, ignored when they don't.

Port 2421 is registered. It just doesn't seem like anyone ever used it.