Port 3163: RES-SAP — A Registered Port Almost No One Knows

What This Port Is

Port 3163 is a registered port — it falls in the 1024–49151 range that IANA manages on behalf of software vendors and protocol designers. Unlike well-known ports (0–1023), registered ports don't require elevated privileges to bind to, which makes them the natural home for application-layer protocols and enterprise software.

IANA has assigned port 3163 to RES-SAP for both TCP and UDP.¹

What RES-SAP Is

RES-SAP is the internal communication protocol of RES Automation Manager (now part of Ivanti Automation), an enterprise IT automation platform popular in the late 2000s and 2010s.²

The protocol handles two jobs:

• TCP: Persistent connections between automation agents (the workers) and dispatchers (the coordinators). This is the main data channel — job assignments, status updates, results.
• UDP: Discovery and broadcasting. Agents use UDP on this port to announce themselves on the network, letting dispatchers find them without manual configuration.

The pattern is common in enterprise software: TCP for work, UDP for finding each other. RES-SAP on port 3163 is that handshake.

Gaming Traffic

Security guides for older Ubisoft games — including Tom Clancy's H.A.W.X. and titles in the Rainbow Six franchise — list port 3163 as part of a range that may appear in firewall logs.³ This isn't an official gaming protocol assignment; it's observed traffic. Games often spray connections across ranges of registered ports for matchmaking and peer coordination.

If you're running neither RES Automation Manager nor a 2009 Ubisoft title, you shouldn't see anything on this port.

Checking What's Listening

# macOS / Linux
sudo lsof -i :3163

# Linux (alternative)
sudo ss -tlnp | grep 3163

# Windows
netstat -ano | findstr :3163

If something shows up, look at the process name. RES/Ivanti automation agents are the expected tenant. Anything else is worth investigating.

Why Unassigned-Looking Ports Matter

Most registered ports are quiet most of the time. Port 3163 sits in a range dense with legacy enterprise software — protocols that were registered, deployed, and then largely forgotten as the companies that built them merged, pivoted, or disappeared.

This is normal. The registered port range is big (over 48,000 ports), IANA's registry is the authoritative record, and plenty of entries point to software that hasn't had an active user base in years. The port itself doesn't expire. The registration just sits there, a small marker that someone once cared enough to formally claim it.