Port 3159: NavegaWeb Tarification — A Quiet Port with a Dark Neighbor

What This Port Is

Port 3159 sits in the registered port range (1024–49151). IANA officially assigns ports in this range to specific services upon application. Port 3159 is assigned to NavegaWeb Tarification on both TCP and UDP — a billing and call-rating system associated with a Spanish Internet provider from the early 2000s. The service appears to be defunct. You are unlikely to encounter it.

If you see traffic on port 3159, NavegaWeb is almost certainly not why.

The Mydoom Connection

In January 2004, Mydoom.A spread faster than any worm before it. At its peak, one in every ten emails on the Internet was a Mydoom infection attempt. It holds that record to this day.

Mydoom.A installed a backdoor that let attackers remotely control infected machines. The backdoor didn't use a fixed port. It scanned for the first available TCP port in the range 3127 to 3198 and listened there. Port 3159 was in that range — not a target, not a signature, just one of the ports the backdoor might land on depending on what else was running on the machine.

This is why port 3159 appears in older security databases flagged as "associated with Mydoom." Not because Mydoom chose it specifically, but because Mydoom chose whatever was available, and sometimes that was 3159.¹

Mydoom's primary backdoor port was 3127. If you see references to port 3159 in legacy firewall rules or security advisories, that context explains them.

How to Check What's Listening

If port 3159 is active on your machine, you can identify what's using it:

Linux / macOS:

sudo ss -tlnp | grep 3159
# or
sudo lsof -i :3159

Windows:

netstat -aon | findstr :3159

The process ID in the output will tell you exactly what's listening. Cross-reference with Task Manager or ps aux to identify the application.

Why Unassigned-in-Practice Ports Matter

Most registered ports are assigned to services that are no longer widely deployed, or were never widely deployed to begin with. NavegaWeb Tarification is one of hundreds of ports with an official assignment that exists only in a registry database.

This matters because security tools can't rely on port numbers to identify traffic. A port number is a declaration of intent, not a guarantee of contents. Malware has always exploited this — using registered ports, well-known ports, even port 80 and 443, to blend in with legitimate traffic.

Port 3159 is a minor illustration of a major principle: what's on a port matters more than what the port is named.