Port 3708: sun-as-iiops — The Naming Service for a Dead Empire

What This Port Is

Port 3708 is registered with IANA as sun-as-iiops — the naming service for Sun Java System Application Server, registered in November 2005.¹

"IIOP" stands for Internet Inter-ORB Protocol, the wire protocol behind CORBA (Common Object Request Broker Architecture). The naming service is what let Java clients look up remote objects using JNDI — the Java Naming and Directory Interface. Before you could call a remote EJB or find a distributed service, you had to ask the naming server where it lived. That's what port 3708 was for.

Sun Microsystems was acquired by Oracle in 2010. The application server became Oracle GlassFish. The port registration persists in the IANA database unchanged.

The Registered Range

Port 3708 sits in the registered ports range (1024–49151). These are ports that applications can register with IANA to claim for a specific protocol, but unlike well-known ports (0–1023), they don't require elevated privileges to use and aren't reserved in any enforceable way.

The registered range is a mix of thriving protocols, deprecated experiments, and entries like this one — accurate records of what mattered at a particular moment in computing history.

The Technology Behind It

CORBA and IIOP were serious infrastructure. The 1990s vision was ambitious: a universal object bus where a C++ object on one machine could call methods on a Java object on another, transparently, across any network. IIOP was the protocol that made this interoperable. Sun's Application Server was a full implementation — it deployed EJBs, managed transactions, handled clustering, and used IIOP naming to wire everything together.

Port 3700 handled standard IIOP traffic. Port 3820 handled IIOP over SSL. Port 3708 handled the naming service specifically — the directory lookup that told clients where to find things.²

It worked. Enterprises ran it. Banks ran it. It was real infrastructure carrying real load.

Then HTTP got faster, REST got popular, and CORBA's complexity started looking like a liability rather than a feature. The industry moved on. Not dramatically — just gradually, deployment by deployment, until the remaining CORBA installations became a maintenance concern rather than a design choice. Today, gRPC handles what IIOP was meant to handle, and does it over HTTP/2 with a fraction of the ceremony.

What You'll Find on This Port Today

Almost certainly nothing. If you encounter something on port 3708, it's either:

• Legacy Sun/Oracle application server infrastructure — unlikely to be new, possibly still maintained in large enterprise environments
• Software that chose this port opportunistically — applications picking any available registered port for internal use
• Malware or unexpected services — worth investigating

How to Check What's Listening

On Linux or macOS:

# See what process owns port 3708
sudo lsof -i :3708

# Or with ss
ss -tlnp sport = :3708

# Or with netstat
netstat -tlnp | grep 3708

On Windows:

netstat -ano | findstr :3708
# Then match the PID
tasklist | findstr <PID>

If something is listening on port 3708 and you don't know why, that's worth knowing.

Why Registered Ports Like This Matter

The IANA registry does something subtle but important: it prevents collisions. When Sun registered 3708 in 2005, they were claiming it in the public record. Other software authors would (ideally) check and choose something else.

The registry has gaps and ghost registrations like this one throughout. A port can be registered to software that's been discontinued for fifteen years and it stays registered — there's no expiration, no reclamation process. The result is a registry that accurately records history but imperfectly reflects what's actually in use.

That's not a flaw. It's the nature of standards bodies and the Internet's commitment to backward compatibility. Somewhere, a Sun Application Server from 2007 might still be running. Its port 3708 should still work. The registration protects that.