Port 2103 – zephyr-clt / MSMQ RPC (Zephyr Notification Service)

Port 2103 is registered by IANA as zephyr-clt — the “serv-hm connection” of MIT Project Athena’s Zephyr Notification Service, a 1980s instant-messaging and notification system that has almost no modern footprint. (The server half of Zephyr, zephyr-srv, actually sits on the neighbouring port 2102; 2103 is the client/host-manager side.) In practice, though, an open 2103 on a live network almost always means something else: TCP 2103 is one of the RPC ports used by Microsoft Message Queuing (MSMQ) on Windows. MSMQ’s main listener is TCP 1801, but it also binds fixed RPC ports 2103 and 2105 (plus 2107 on MSMQ 3.0+) for remote queue reads and management, located via RPC on port 135. So when 2103 turns up on a scan, the real question is whether you’re looking at a vestigial Zephyr label or an MSMQ-enabled Windows host — and it’s nearly always the latter.

Why It’s Open

• MSMQ is installed, usually unintentionally. By far the most common reason 2103 is open. MSMQ ships as an optional Windows feature but is pulled in silently by Exchange, Dynamics, and older .NET apps; once mqsvc.exe runs it binds 1801 plus the RPC ports 2103/2105/2107. The full MSMQ picture lives on port 1801.
• It rarely travels alone. An MSMQ host almost always exposes RPC 135 and TCP 1801 next to 2103, and often 2105 and 2107 — that cluster is the tell.
• Legacy Zephyr assignment. The IANA zephyr-clt name lingers in /etc/services and scanner databases, so a tool may still label 2103 “zephyr” on a Windows host that has never run Zephyr — the same stale-label trap as the obscure cadlock port 1000.
• Genuine Zephyr is rare. Real Zephyr Notification Service deployments survive mostly in academic, MIT-Athena-derived networks, so actual zephyr-clt traffic is the exception, not the rule.

Common Risks

• It confirms an MSMQ attack surface. On Windows, an open 2103 is a strong signal that MSMQ is enabled — which since 2023 means exposure to the MSMQ vulnerability cluster. The remote-code-execution risk lives on the MSMQ protocol itself, not on 2103, so the finding here is “MSMQ is present — go assess it on 1801.”
• RPC remote reads and management. 2103 and 2105 carry RPC-based remote reads of public and private queues, and 2107 exposes remote management APIs. Reachable from an untrusted network, that widens the MSMQ surface beyond the main 1801 listener.
• Partial firewalling gives false comfort. Because MSMQ spreads across 1801/2103/2105/2107/135, blocking only 1801 can leave the RPC paths open. The whole set has to be restricted together.
• A mislabelled service is a missed finding. A stray “zephyr” label can lead an analyst to dismiss an MSMQ-enabled host. Never trust the port name — confirm the service.
• Unencrypted legacy Zephyr, if genuinely present. In the rare real-Zephyr case, notifications may travel without encryption and lean on Kerberos that is easy to misconfigure — an information-disclosure concern in academic environments.

Want to save time on reporting?

Let PentestPad generate, track, and export your reports - automatically.

Book a Demo

Enumeration & Testing

Detect and fingerprint the service

nmap -sV -p 2103 <target>

Nmap may print zephyr-clt from its service database — treat that as a guess from the port number, not a verified protocol. On a Windows host it is almost certainly MSMQ.

Scan the full MSMQ port set

nmap -sV -p 135,1801,2103,2105,2107 <target>

If 2103 opens alongside 1801, 135, and 2105/2107, that fingerprint is the clearest sign MSMQ is enabled — pivot to the MSMQ checks on port 1801.

Raw banner grab

nc -nv <target> 2103

A raw connect confirms the port answers and can reveal whether you’re talking to genuine Zephyr or a silent RPC endpoint.

Log every host where you confirm what’s really on 2103, plus its patch state, so the evidence lands in the pentest report instead of a scratch terminal.

What to Look For

Known CVEs and Exploits

• No CVEs for zephyr-clt or the Zephyr Notification Service. MIT’s Zephyr has essentially no CVE history as a network service. The many “Zephyr” entries on NVD are for the unrelated Zephyr RTOS embedded operating system — a different project that has nothing to do with this port.
• The real exposure is MSMQ. If 2103 is open because MSMQ is enabled, the relevant issues are the MSMQ ones — headlined by CVE-2023-21554 (QueueJumper), an unauthenticated remote code execution flaw (CVSS 9.8) patched in April 2023, plus the wider cluster of roughly 20 MSMQ CVEs from that year. These target the MSMQ protocol whose primary listener is TCP 1801, not 2103 (an RPC port) — full detail, detection, and the QueueJumper check live on the port 1801 page.
• Old page claim removed. A previous version of this page cited CVE-2004-0192 as a “Zephyr notification service buffer overflow.” That is wrong: CVE-2004-0192 is a cross-site scripting flaw in Symantec Gateway Security 2.0, unrelated to Zephyr or port 2103. It has been removed, along with the unverifiable “authentication bypass” and “message injection” claims that accompanied it.

Mitigation

• If MSMQ is running and unused, disable it. Remove the Message Queuing Windows feature or stop and disable mqsvc.exe, then rescan — this closes 1801 and the 2103/2105/2107 RPC ports together. This is the highest-impact fix, because most exposed MSMQ is an unintended dependency nobody needs.
• Patch and stay current. Apply the April 2023 update that fixed QueueJumper and keep up with later Windows updates — the 2023 MSMQ cluster was patched over several months.
• Firewall the whole MSMQ port set. Restrict TCP 1801, 2103, 2105, 2107, and RPC 135 to trusted application tiers, and never expose any of them to the internet.
• Otherwise, identify what’s really on 2103. If it isn’t MSMQ, fingerprint the listener; keep genuine Zephyr’s Kerberos correctly configured and encrypt where possible, and disable whatever is on 2103 if it isn’t sanctioned.

Real-World Example

When Check Point Research disclosed QueueJumper (CVE-2023-21554) in April 2023, roughly 360,000 hosts had MSMQ exposed to the internet — and on almost every one, a scan showed the same cluster: TCP 1801 with 135, 2103, 2105, and 2107 beside it. That RPC-port fingerprint, not the QueueJumper packet’s target port, is usually what first tells an auditor MSMQ is enabled. The trap on 2103 specifically is the label: a scanner prints zephyr-clt, an analyst thinks “some old MIT messaging thing,” and walks past an MSMQ-enabled Windows box that was one packet away from unauthenticated RCE. Genuine Zephyr Notification Service traffic on 2103 does still exist in a handful of academic networks — but on a modern corporate network, the port almost always means MSMQ.

FAQ

What is port 2103 used for?

Port 2103 is registered by IANA as zephyr-clt, part of MIT Project Athena’s Zephyr Notification Service (the server, zephyr-srv, is on port 2102). In practice, on a modern Windows network an open 2103 is almost always one of the RPC ports used by Microsoft Message Queuing (MSMQ), which listens on TCP 1801 and binds 2103, 2105, and 2107 for remote queue reads and management.

Is port 2103 an MSMQ port?

Yes — on Windows it usually is. MSMQ’s main listener is TCP 1801, but it also uses fixed RPC ports 2103 and 2105 (and 2107 on MSMQ 3.0+), discovered through RPC on port 135. So an open 2103 sitting next to 1801 and 135 is a strong sign the MSMQ feature is enabled on the host.

What is zephyr-clt, and how is it different from zephyr-srv?

Both are service names IANA assigns to MIT’s Zephyr Notification Service. zephyr-srv (port 2102) is the server; zephyr-clt (port 2103) is the “serv-hm connection” between the client’s host manager and the server. The service is a 1980s Project Athena messaging system with almost no modern deployment, which is why the assignment on 2103 is largely vestigial today.

Is port 2103 dangerous?

The port isn’t dangerous by itself, but what it usually indicates can be. On Windows it signals an MSMQ-enabled host, and MSMQ has been affected since 2023 by critical unauthenticated bugs such as QueueJumper (CVE-2023-21554). Treat an open, unexplained 2103 as “confirm MSMQ and assess it on port 1801.”

How do I close port 2103?

If it’s MSMQ and nothing needs it, remove the Message Queuing Windows feature or stop and disable the service, then rescan — that closes 1801 and the 2103/2105/2107 RPC ports at once. If MSMQ is required, patch it and firewall the whole port set to trusted tiers. If it’s something else, identify the listener and disable it if it isn’t sanctioned.

TL;DR

• Service: IANA zephyr-clt (MIT Zephyr Notification Service; zephyr-srv is port 2102) — effectively vestigial. In practice, an MSMQ RPC port on Windows.
• Default port: 2103/TCP (also UDP); MSMQ uses it alongside 1801, 2105, 2107, and 135.
• Biggest risk: an open 2103 flags an MSMQ-enabled host — exposure to the 2023 MSMQ CVE cluster (QueueJumper, CVE-2023-21554). There are no zephyr-clt CVEs of its own.
• Mitigation: confirm MSMQ vs Zephyr, disable MSMQ if unused, patch, and firewall the whole MSMQ port set (1801/2103/2105/2107/135).