Port 3592: Unassigned — Home to Cerbos

What Port 3592 Is

Port 3592 sits in the registered port range (1024–49151). IANA maintains this range — any organization can apply to have a service officially assigned to a port here. Port 3592 has no taker. IANA lists it as unassigned.

That doesn't mean it's empty.

The Cerbos Connection

Cerbos — an open-source policy-based authorization engine — chose port 3592 as its default HTTP port.¹ Its companion gRPC server lands on 3593, right next door.²

Cerbos sits between your application and your data, evaluating authorization decisions: Can this user edit this document? Does this service account have permission to trigger that action? Every check flows through an HTTP request to port 3592 (or gRPC on 3593), which responds with a simple allow or deny.

If you run Cerbos in Docker or locally and haven't changed the defaults, something is listening on 3592.

What the Registered Range Means

The registered range is a middle ground between two extremes:

• Well-known ports (0–1023) are reserved for foundational protocols — HTTP on 80, SSH on 22, DNS on 53. You need root privileges to bind them on most systems.
• Ephemeral ports (49152–65535) are handed out dynamically to clients for outbound connections. They're temporary by design.

Registered ports are for everyone else — services that want a stable, documented home without claiming one of the prestigious low-number slots. Cerbos claimed 3592 informally. It works, even without IANA's blessing.

Checking What's on This Port

To see if anything is listening on port 3592 on your system:

# macOS and Linux
lsof -i :3592

# Linux (alternative)
ss -tlnp | grep 3592

# Windows
netstat -ano | findstr :3592

If you see Cerbos (or a process named cerbos), that's expected. If you see something else, that's worth investigating.

Why Unassigned Ports Matter

The port numbering system only works if ports mean something consistent. When a service picks an unassigned port as its default, it's making an informal claim — betting that no official assignment will arrive later and conflict with its users' deployments.

Most of the time, this works fine. The Internet runs on countless such informal agreements.