Port 3294: fg-gip — Registered, Undocumented

What Port 3294 Is

Port 3294 sits in the registered ports range (1024–49151). These ports are not freely available like the ephemeral ports above 49151, and they're not tightly controlled like the well-known ports below 1024. They're the middle tier: anyone can apply to IANA for a registered port, and IANA will record the claim.

Port 3294 has a recorded claim. IANA lists it as fg-gip for both TCP and UDP, registered by a contact named Jean-Marc Frailong.¹ That's where the paper trail ends.

The Undocumented Registration

No RFC defines fg-gip. No official protocol specification has been published. The name follows a pattern — "fg" is the prefix Fortinet uses across its proprietary protocols (FGCP for clustering, FGSP for session sync, FGFM for FortiManager communication) — suggesting this may be a Fortinet product registration. But Fortinet's public documentation doesn't reference port 3294, and there's no confirmation of that connection.²

This happens. The registered ports list contains hundreds of entries that were claimed, never fully specified, and quietly forgotten. The registration doesn't expire. The name persists. The protocol stays a ghost.

Is It Used for Anything?

No widely observed unofficial use of port 3294 has been documented. No common software is known to default to this port. No security advisories have flagged it as associated with malware or exploitation.

If you see port 3294 open on a system, it was put there by something specific to that system — not by a protocol the broader Internet uses.

What's Listening on This Port?

To see what process has port 3294 open:

Linux/macOS:

# Show which process is listening on port 3294
sudo ss -tlnp | grep 3294
# or
sudo lsof -i :3294

Windows:

netstat -ano | findstr :3294

Then cross-reference the PID with Task Manager or tasklist to identify the process.

Why Unassigned Ports Matter

Port 3294 illustrates something real about how the port system works in practice. The 65,535 available ports are finite. Registrations persist indefinitely. And the gap between "registered" and "actively documented and used" is wide — full of names like fg-gip that hold a number without holding a story.

When a port has no known service, the question to ask isn't "what should be here?" It's "what is actually here, on this machine, right now?" The registry tells you what someone once claimed. Only your system can tell you what's actually listening.