The RMI activation daemon's internal registry — a removed Java feature that still shows up on old JBoss and legacy JVM stacks.
Running rmid started the Java RMI activation system and, per Oracle's documentation, "starts the Activator and an internal registry on the default port 1098" with an ActivationSystem bound into it. RMI Activation was deprecated in Java SE 15 and removed outright in Java SE 17 by JEP 407, so anything listening here is running an old JVM or an old application server. In practice 1098 most often turns up next to 1099 on legacy JBoss deployments, which used it for naming-service RMI callbacks to client proxies.
Do not expose
It is a Java RMI endpoint that deserializes attacker-supplied objects; RMI ports reachable from untrusted networks are a standard remote-code-execution path.
$ nmap -Pn -p 1098 --script rmi-dumpregistry TARGETSeen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.