Registered as 3d-nfsd, used in the real world as a second telnet port on embedded devices — and scanned constantly because of it.
IANA registers 2323 as 3d-nfsd, a name you will effectively never see on the wire. What actually listens here is telnet: consumer routers, IP cameras, DVRs, and other embedded gear that either moved telnet off 23 or ran a second instance on 2323. Mirai and its many derivatives scan both 23 and 2323 and try lists of default credentials against whatever answers, which is why 2323 sees continuous unsolicited traffic on any public IP. The leaked Mirai source shows the scanner and its credential list directly.
Do not expose
Cleartext login with no server authentication, on the exact port a decade of IoT botnets brute-force by default. There is no safe internet-facing configuration — disable it and use SSH.
$ nc -v TARGET 2323Seen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.