Port 3161: DOC1 License Manager — A Registered Port Nobody Talks About

What This Port Is

Port 3161 sits in the registered port range (1024–49151), where IANA formally assigns port numbers to specific applications on request. Unlike the well-known ports below 1024 — which carry HTTP, SSH, DNS, and the other protocols that built the Internet — registered ports belong to specific products, many of them niche enterprise software from eras past.

This port is formally registered to DOC1 License Manager (service name: doc1lm), assigned on both TCP and UDP.¹

What DOC1 Was

DOC1 was a document composition platform made by Group 1 Software, later acquired by Pitney Bowes. It was built for one purpose: generating high-volume, data-driven print communications. Invoices. Statements. Insurance notices. The kind of structured documents that arrive in envelopes and look like they came off a mainframe — because they did.

The license manager component (doc1lm) handled software licensing for DOC1 installations across enterprise networks. It needed a port to communicate between client machines and the license server. Port 3161 is what it got.

DOC1 has reached end-of-support for its older series.² The port number remains in the registry regardless.

What "Registered" Actually Means

Registration with IANA is not the same as active use. Any organization can apply for a registered port assignment.³ The bar is relatively low. Once registered, the assignment persists in the registry indefinitely — there is no expiration, no audit of whether the software still exists, no check that anyone is still listening on that port.

Port 3161 illustrates this gap well. It has a formal name, a formal service identifier, and almost zero presence in modern network discussions.

If you see traffic on port 3161 on your network and you are not running DOC1, the honest answer is: something else is using it. Registered ports are not exclusive — any application can bind to any port. The registration is a courtesy claim, not an enforced monopoly.

How to Check What Is Listening

If port 3161 is open on a machine you manage, find out what process owns it:

On Linux or macOS:

sudo ss -tlnp | grep 3161
# or
sudo lsof -i :3161

On Windows:

netstat -ano | findstr :3161
# Then look up the PID:
tasklist | findstr <PID>

With Nmap (from another machine):

nmap -sV -p 3161 <target-ip>

The -sV flag asks Nmap to probe the service and attempt to identify what is actually running, not just report that the port is open.