Port 3226: Registered but Quiet — a Ghost Assignment in the Citrix Shadow

Port 3226 sits in the registered ports range (1024–49151). These ports can be claimed through IANA's official registration process, and port 3226 has been claimed — by "ISI Industry Software IRP," for both TCP and UDP.

In practice, that registration is a ghost. No meaningful documentation of what ISI's IRP protocol actually does exists in the public record. The name is on the books. The protocol is nowhere.

What Actually Runs Here

If you find port 3226 open in the wild, it's almost certainly Citrix Framehawk.

Framehawk is Citrix's technology for delivering virtual desktops over lossy, high-latency connections — the kind of degraded network where standard TCP-based display protocols struggle. It uses UDP instead of TCP, tolerating dropped packets the way a phone call tolerates static, prioritizing responsiveness over perfect delivery. The default port range for Framehawk is UDP 3224–3324, and port 3226 falls squarely inside it.¹

In a typical deployment, Framehawk runs between a Citrix Receiver client and a NetScaler Gateway, encrypted with DTLS (Datagram Transport Layer Security). The firewall rules for these environments often open the entire 3224–3324 range rather than individual ports — which means port 3226 gets opened as part of a block, not because anyone specifically chose it.²

Framehawk is a deprecated feature as of recent Citrix Virtual Apps and Desktops releases, replaced by adaptive transport mechanisms. But legacy deployments still use it, and those UDP ranges remain open on older firewalls long after the feature is gone.

How to Check What's Listening

# macOS / Linux
sudo lsof -i :3226

# Linux (alternative)
sudo ss -tulpn | grep 3226

# Windows
netstat -aon | findstr :3226

The output will show you the process name and PID. From there, match the PID against your running processes to understand what's actually there.

Why Unassigned Ports Matter

The registered ports range exists so software vendors can stake a claim before shipping. It prevents two different applications from accidentally colliding on the same port — in theory. In practice, registration is voluntary, enforcement is nonexistent, and the real arbitration happens at the firewall and in the defaults baked into software.

Port 3226 illustrates this perfectly: IANA says it belongs to one thing, Citrix uses the range for another, and neither party coordinated. This is normal. The port numbering system is less a controlled namespace and more a first-come, first-squatted territory with a nominal registration desk.