Port 3536: SNAC — A Name Without a Protocol

What Port 3536 Is

Port 3536 sits in the registered port range (1024–49151). These ports aren't free-for-all — IANA maintains a registry of assignments, and anyone can apply to claim one for a protocol or service.

Port 3536 has a registration. IANA lists it as snac, registered in July 2002 by a contact named Tatsuya Igarashi, assigned to both TCP and UDP. That's the entirety of the public record.¹

No RFC backs it. No documentation explains what "snac" does. No known software ships with it configured. The registration exists; the protocol does not appear to have followed.

This is not unusual. The registered port range is full of entries like this — protocols registered in anticipation of deployment, internal tools that never went public, and names claimed and then abandoned. The IANA registry is a statement of intent, not a guarantee of existence.

What the Registered Port Range Means

Ports 1024–49151 are the middle tier of the port number space:

• Well-known ports (0–1023): Assigned to fundamental protocols — HTTP, SSH, DNS. Require root/admin privileges to bind on most systems.
• Registered ports (1024–49151): IANA tracks assignments, but binding doesn't require elevated privileges. The registry is advisory, not enforced.
• Dynamic/ephemeral ports (49152–65535): Unregistered, used temporarily for outbound connections.

A service claiming a registered port is supposed to file with IANA so the space doesn't collide. In practice, plenty of software ignores this entirely, and plenty of registered entries — like 3536 — represent protocols that never shipped.

How to Check What's Listening on Port 3536

If you see traffic on port 3536, it's almost certainly custom or proprietary software — not "snac," whatever that was meant to be.

On Linux/macOS:

ss -tlnp | grep 3536
# or
lsof -i :3536

On Windows:

netstat -ano | findstr :3536

Match the PID to a process name using Task Manager or Get-Process -Id <PID> in PowerShell.

With nmap (remote):

nmap -sV -p 3536 <target>

Service version detection (-sV) will attempt to identify what's actually running, regardless of what the registry says should be there.