3
Summary
- // if you see it open
- An open port 3/tcp is rare and typically unintentional. No specific named malware family is confirmed to use port 3/tcp as a primary C2 or backdoor port in current sources (some older databases vaguely flag it as historically misusable, but name no trojan). Because the number is de-assigned and no legitimate service claims it, any listener found on port 3/tcp in a modern environment warrants investigation.
- // analyst note
- Port 3/tcp is de-assigned and effectively vacant; legitimate use is unlikely. Treat a responsive port 3 as an anomaly worth investigating, not a known service.
About port 3/tcp.
Port 3/tcp is currently Reserved in the IANA Service Name and Transport Protocol Port Number Registry, with a blank Reference field. It was not always vacant: for decades it carried the assignment compressnet ("Compression Process"), one half of the two-port CompressNET pair — port 2 ran the Management Utility and port 3 ran the Compression Process itself. The assignment was registered by Bernie Volz (then of Process Software Corporation, a VAX/VMS networking shop) and appears in RFC 1340 (Assigned Numbers, July 1992) listed as "compressnet / Compression Process" with contact BV15; no dedicated RFC ever specified the CompressNET protocol on the wire. CompressNET was an early concept for compressing data in transit to save bandwidth on the low-capacity links of the era, and it was never widely deployed — data compression is now handled in the application and transport layers of modern protocols (HTTP gzip/Brotli, TLS record compression and its successors), so the dedicated low-numbered port lost its rationale. IANA de-assigned the entry on 2025-02-13, and the same de-assignment was applied to 3/udp, which sits on the matching registry line with identical Reserved status. For an analyst the practical takeaway is that a host listening on port 3/tcp today is statistically rare and almost always unintentional: no widely distributed software is known to bind to it, no specific named malware family is confirmed to use it as a primary C2 or backdoor port in current sources, and large-scale scanning studies (ZMap, CAIDA) do not flag port 3 as a notable target. Because the number is de-assigned and no legitimate service claims it, any listener found there in a modern environment warrants investigation rather than being treated as a normal service.
- IANA assignment
- Reserved as of 2025-02-13; previously
compressnet— "Compression Process"; reference (blank — no RFC cited in IANA registry); previous assignee Bernie Volz; de-assigned 3/tcp + 3/udp together [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry line 8; https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=compressnet) - Range class
- well-known (0–1023)
- Modification/de-assignment date
- 2025-02-13 (first-party IANA registry fact) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry line 8
- Related ports
- port 2 (compressnet Management Utility, the other half of the CompressNET pair); dual-registered 3/udp (identical Reserved status)
Primary use
historical CompressNET "Compression Process" — early data-in-transit compression to save link bandwidth; one of two ports (2 = Management Utility, 3 = Compression Process); never widely deployed
Common software
none identified; no widely distributed software is known to bind to port 3/tcp today
Security implications
an open port 3/tcp is rare and typically unintentional; no specific named trojan or active malware family is confirmed at this port in current sources (some older databases vaguely flag it as historically misusable); de-assigned with no legitimate service, so any listener warrants investigation; ZMap/CAIDA scanning studies do not call out port 3
Typically seen on
nothing in normal operation; an open port 3 is an anomaly / possible decoy or backdoor
- RFC reference
- RFC 1340 (Assigned Numbers, 1992) lists port 3 as "compressnet / Compression Process," contact BV15; no dedicated CompressNET protocol RFC is known; IANA Reference column is blank [Confirmed] — RFC 1340 (https://datatracker.ietf.org/doc/html/rfc1340)
- Analyst note
- Port 3/tcp is de-assigned and effectively vacant; legitimate use is unlikely. Treat a responsive port 3 as an anomaly worth investigating, not a known service.
About port 3/udp.
Port 3/udp is currently Reserved in IANA's Service Name and Transport Protocol Port Number Registry: the service-name field is empty and there is no active assignee. It previously held the assignment compressnet — "Compression Process" — attributed to Bernie Volz, but that assignment was formally de-assigned on 2025-02-13, and the same de-assignment was applied to the matching 3/tcp registration on the same date, so both transports now carry an identical Reserved status. The Reference column in the IANA registry is blank — no RFC was ever filed for this port, and none should be invented. The compressnet idea was to provide a standard well-known port for a network-layer compression process on the wire, but it was never widely deployed and no significant real-world implementation is documented; third-party port references that still label port 3 "compressnet / Compression Process" are reflecting the historical assignment, not a live service. For an analyst there is essentially nothing legitimate to expect here: the port carries no real service, so any traffic observed on 3/udp in the wild is most plausibly background internet noise — mass scanner probes, spoofed packets, or misconfigured software — rather than genuine compressnet activity. UDP scanning of this port is inherently unreliable, since a non-response cannot distinguish open|filtered from a dropped packet and ICMP-unreachable rate-limiting further muddies the result. No CVEs, malware families, trojans, exploit kits, or botnets are publicly attributed to port 3/udp, and firewalls can safely block inbound 3/udp with no operational impact. No Shodan or internet-scan survey data specific to 3/udp was publicly available at research time.
- IANA assignment
- Reserved — service-name field blank; no active assignee; Reference column blank (no RFC) [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry
- Dual registration
- 3/tcp carries the identical Reserved status and was de-assigned on the same date (2025-02-13) [Confirmed] — IANA registry
- Range class
- well-known (0–1023)
Primary use
none today; historically intended as a network-layer Compression Process (compressnet), never widely deployed
Common software
Unknown — no documented mainstream software or daemon is known to have implemented compressnet on 3/udp [Unknown]
Security implications
no CVEs, malware, trojans, exploit kits, or botnets documented; traffic on 3/udp is most plausibly background noise (scanners, spoofing, misconfiguration); UDP scanning is unreliable (open|filtered ambiguity, ICMP rate-limiting)
Exposure / scanning
not a meaningful attack surface; firewalls may block inbound 3/udp with no operational impact; any open|filtered result is most plausibly noise
- Prior assignment
compressnet— "Compression Process," attributed to [Bernie_Volz]; de-assigned on 2025-02-13 [Confirmed] — IANA registry- Internet-scan data
- no Shodan or scan-survey data specific to 3/udp publicly available at research time [Unknown]
- Analyst note
- 3/udp is a dead/Reserved port — treat any traffic as background noise rather than a live service, and investigate only as anomaly/decoy if persistent.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| compressnet | UDP | Compression Process | 0.15% |
| compressnet | TCP | Compression Process | 0.12% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.