Port 2949: WAP Push Secure — A Relic of the Mobile Web's First Act

What This Port Is

Port 2949 is IANA-registered for WAP PUSH SECURE (service name: wap-pushsecure), assigned to both TCP and UDP. It is the encrypted sibling of port 2948, which handles plain WAP Push MMS.

In practice, you will almost never see traffic on this port in 2025. It belongs to a different era.

The WAP Era

In the late 1990s and early 2000s, mobile phones needed their own Internet. The wired web required processors and screens that phones didn't have. So the WAP Forum — a consortium of Nokia, Ericsson, Motorola, and phone carriers — built the Wireless Application Protocol: a parallel stack with its own browser engine (WAP Browser), its own markup (WML, not HTML), and its own transport layer.¹

WAP 2.0, released in August 2001, introduced Multimedia Messaging Service. To deliver MMS to a phone, the carrier's MMS center needed to push a notification telling the device to go fetch its message. That push mechanism needed ports. The WAP Forum registered two adjacent ones:

• Port 2948 — WAP Push MMS (plain)
• Port 2949 — WAP Push Secure MMS (encrypted)

Port 2949's "secure" designation meant the push notification traveled over an encrypted channel, protecting the delivery instruction (though not necessarily the message content itself) from interception.²

Why You Won't See It

WAP was a sincere attempt to solve a real problem, but it was also deeply awkward to use. Pages were stripped-down, navigation was painful, and the experience never felt like the real web — because it wasn't.

The iPhone launched in 2007. Within a few years, smartphones were running actual browsers over actual HTTP. Carriers migrated MMS delivery to standard IP infrastructure. The WAP stack was abandoned. Port 2949 kept its IANA registration, but the protocol it served has no meaningful presence on modern networks.³

Checking What's on This Port

If you see traffic on port 2949 on a modern machine, it isn't WAP. Something else has claimed it — intentionally or by coincidence.

To check what's listening:

# macOS / Linux
sudo lsof -i :2949

# Linux alternative
sudo ss -tlnp | grep 2949

# Windows (PowerShell)
netstat -ano | findstr :2949

If something shows up, check the process name and verify it's expected software. Port 2949 has no established modern use, so an unexpected listener warrants a look.

Related Ports