This article explains the specific use of UDP port 2000 in Control Manager (TMCM).
TMCM uses Port 2000 UDP to handle its heartbeat communication process. The communicator module on MRF applies UDP to send the heartbeat.
For Proxy servers, the Trend Micro Infrastructure (TMI) only supports sending the UDP data by passing Socks 5 proxy servers. To send UDP data, it generates a TCP connection by creating a UDP connection request to a Socks 5 proxy server, after which it sends UDP data to the proxy server. It also provides APIs for MRF to monitor the TCP connection that was established between the sender and proxy server for sending UDP data.
The 2000 UDP port that sends traffic, as shown below:
UDP 0.0.0.0:2000 *:* 2728 [mrf.exe]
Control Manager always uses this port if a Socks 5 proxy for TMI communication is not in use. The Communicator tries to bind ports from 2000 up to 2014 UDP (it will bind the first available port).