Port 3587: Peer Networking Grouping — Windows' Forgotten P2P Port

What Port 3587 Is

Port 3587 is a registered port assigned to p2pgroup, the Windows Peer-to-Peer Grouping protocol. It lives in the registered port range (1024–49151), meaning it has a formal IANA entry — but the service it was registered for has largely faded from relevance.

If you see port 3587 open on a Windows machine, you're probably looking at a remnant of Microsoft's peer-to-peer networking stack.

The Registered Port Range

Ports 1024–49151 are registered ports. Anyone can apply to IANA to claim one for a specific protocol, and IANA will record the assignment. This doesn't mean the protocol is widely used — it means someone filed the paperwork.

Registered ports are different from the well-known ports (0–1023), which are tightly controlled and used by foundational protocols like HTTP, DNS, and SSH. Registered ports are more like a land registry: the owner has a deed, but the property might be a vacant lot.

Port 3587 has a deed. The lot is mostly vacant.

The Windows P2P Stack

In the early 2000s, Microsoft built a peer-to-peer networking SDK into Windows — starting with Windows XP SP2 and expanding through Vista. The goal was to let applications create private, secure peer groups without a central server.

The stack had three layers:

• PNRP (Peer Name Resolution Protocol) — decentralized name resolution, running on port 3540 UDP
• The Graphing API — for direct peer-to-peer graph communication
• The Grouping API — a higher-level layer combining PNRP and graphing, adding PKI-based security and multiplexing

Port 3587 TCP belonged to that Grouping API. When you opened a firewall for a Windows P2P application, Microsoft's own documentation told you to allow 3587-TCP for grouping and 3540-UDP for PNRP.¹

The Grouping API let developers invite peers, issue Group Member Certificates (to ensure only authorized members could participate), and sign all exchanged records cryptographically. It was genuinely sophisticated infrastructure for its time.

HomeGroup

The most visible thing built on this stack was HomeGroup, introduced in Windows 7. HomeGroup let Windows computers on the same network share files, printers, and media libraries — no server required, no shared folders to configure, no IT knowledge needed.

Port 3587 was part of what made that work.

Microsoft deprecated HomeGroup in Windows 10 version 1803 (April 2018) and removed it entirely in later versions. The reasoning: cloud storage and streaming had made local network sharing feel like a solved problem. Why share a folder over your home network when everything lives in OneDrive?²

Current Status

The p2psvc (Peer Networking Grouping) Windows service still exists on many Windows machines, set to Manual startup. It runs only when something explicitly starts it, and almost nothing does anymore.

There is also a documented security concern: a trojan called ShitHead has been observed using port 3587. This is opportunistic — malware frequently squats on registered-but-quiet ports precisely because traffic there doesn't trigger much scrutiny.³

What's Listening on Your Machine

To check what's using port 3587:

# Windows
netstat -ano | findstr :3587
# Then look up the PID:
tasklist | findstr <PID>

# macOS / Linux
sudo lsof -i :3587
# or
sudo ss -tlnp | grep 3587

On a modern Windows machine, you'll almost certainly find nothing. On a Windows 7 relic still running HomeGroup — possibly something.