IANA registers OPNET's Dynamic Sampling Agent protocol; Unix /etc/services calls it kx, X over Kerberos.
The IANA entry for 2111 is dsatp, the OPNET Dynamic Sampling Agent Transaction Protocol, assigned to OPNET Technologies. Unix service tables and Nmap instead name it kx, "X over Kerberos" — the Kerberized X11 forwarding daemon that shipped with the Kerberos application suite before SSH forwarding replaced it. Neither is common: Nmap finds 2111 open on about 0.03% of hosts. If it is answering, treat it as legacy monitoring or legacy Kerberos plumbing and confirm which by looking at the process.
Do not expose
Both candidates are unmaintained: a monitoring agent transaction port or a Kerberized X-forwarding daemon that hands out display access. Keep it off public interfaces.
$ sudo lsof -nP -iTCP:2111 -sTCP:LISTENSeen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.