A CORBA bootstrap agent — in practice, usually an IBM WebSphere Application Server.
2809 is the default port for a corbaloc: URL, the CORBA Interoperable Naming Service address a client uses to resolve an initial object reference over IIOP without a full naming lookup. Java EE servers built on IIOP inherit it: WebSphere's default JNDI provider URL is literally corbaloc:iiop:localhost:2809, and the port is the WebSphere bootstrap/RMI-IIOP endpoint. On a scan it says "Java application server", and the naming service on it will happily enumerate bound objects to an unauthenticated client.
Do not expose
The bootstrap and naming service usually answer without authentication and it is a Java deserialization path into the application server — keep it behind the perimeter.
$ nmap -Pn -p 2809 --script giop-info TARGETSeen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.