Port 3521: mc3ss — A Registered Port with a Missing Owner

What Port 3521 Is

Port 3521 sits in the registered port range (1024–49151). These ports are assigned by IANA to specific services and applications, distinguishing them from the well-known ports (0–1023) that carry the major protocols of the Internet, and from the ephemeral ports (49152–65535) that operating systems hand out temporarily to client connections.

Being registered doesn't mean a port is widely used or that its assigned service still exists. It means someone once filed paperwork.

The Official Assignment

IANA lists port 3521 (TCP and UDP) as assigned to mc3ss, registered by Telequip Labs. The assignment dates to the early 2000s. Telequip Labs appears to have since vanished — no active website, no surviving documentation, no community using the service. What MC3SS did is effectively lost.¹

This happens more than you'd expect. The registered port range has thousands of assignments from companies and projects that have since folded, been acquired, or simply abandoned their work. The registration stays; the service doesn't.

Observed Unofficial Uses

Two uses have been documented in the wild:

Star Trek fan game. Port 3521 (alongside port 3520 and 2592) was used by at least one network-based multiplayer Star Trek game for game traffic and metaserver communication. This is the kind of informal use that predates modern service discovery — developers picked an available registered port and shipped it.²

W32.Kwbot worm. In the early 2000s, the Kwbot worm (also called K0wbot) spread through KaZaA file-sharing networks, disguising itself as popular files across hundreds of copies in shared folders. The worm used port 3521 as part of its backdoor mechanism — connecting infected machines to remote servers for command and control. The choice of an obscure registered port was deliberate: less scrutiny, less chance of being blocked.³

There are no current high-profile applications known to use port 3521.

How to Check What's Listening

If you see traffic on port 3521, here's how to investigate:

On Linux or macOS:

# Show what process is listening on port 3521
ss -tlnp | grep 3521
# or
lsof -i :3521

On Windows:

netstat -ano | findstr :3521

This will show the process ID. You can then look up the process name in Task Manager or with tasklist | findstr <PID>.

On a router or firewall, unexpected traffic on this port — especially outbound — is worth investigating. The worm associations are old, but the port remains a legitimate place for unauthorized software to hide.

Why Unassigned and Dormant Ports Matter

The registered port range is partly a coordination mechanism and partly a historical record. A port like 3521 illustrates the gap between intention and reality: IANA registration creates order on paper, but the actual use of a port is determined by software in the wild — games, worms, custom applications, and forgotten services all write to this same address space.

Ports without active official services are interesting to security professionals precisely because they generate less noise in logs. Something listening on port 443 or 80 is expected. Something listening on port 3521 is worth a second look.