Port 3649: NMMP — A Name in the Registry

What This Port Is

Port 3649 sits in the registered ports range (1024–49151). These ports are managed by IANA, the Internet Assigned Numbers Authority, which maintains the official list of what each port is supposed to carry.

According to that list, port 3649 belongs to NMMP — the Nishioka Miyuki Msg Protocol, registered in January 2003 by a submitter named TAKEDA Hiroyuki.¹ It was assigned for both TCP and UDP.

That is the entirety of what is publicly known about NMMP.

The Ghost Registration

In the early 2000s, IANA's port registration process was relatively permissive. Developers could submit a protocol name, get a port number assigned, and the registry would record it. Many of these became real, widely-deployed protocols. Others were internal tools, proof-of-concept projects, or personal software that ran on a handful of machines and was never publicly documented.

NMMP appears to be in the latter category. There is no known RFC, no public software, no documentation. The name itself — "Nishioka Miyuki Msg Protocol," named after what appears to be a person — suggests a private or personal messaging system rather than a public protocol intended for broad use.

Most port scanning tools and security databases categorize port 3649 as unassigned because there is no software to associate it with. The IANA entry is real. The protocol it points to is effectively invisible.

What You Might Actually Find on Port 3649

Because this port has no established software using it, anything listening on 3649 on a real system is application-specific — something configured explicitly by whoever set up that machine. Common reasons a port like this gets used:

• Development servers running on a non-conflicting port
• Internal tools that picked an arbitrary registered-but-unused number
• Malware that sometimes parks on obscure registered ports to look less suspicious than using a random ephemeral port

None of these are specific to port 3649. Any of the thousands of similarly quiet registered ports could serve the same purpose.

How to Check What's Listening

If you see traffic on port 3649 and want to know why:

On Linux or macOS:

# Show the process listening on port 3649
sudo ss -tlnp | grep 3649
# or
sudo lsof -i :3649

On Windows:

netstat -ano | findstr :3649
# Then look up the PID:
tasklist | findstr <PID>

With nmap (scanning a remote host):

nmap -sV -p 3649 <target>

The -sV flag tells nmap to attempt service detection — it will try to identify what's actually running rather than just reporting the port is open.

Why Ports Like This Exist

The registered ports range exists to prevent chaos. Without it, two applications might independently choose the same port and conflict. IANA registration creates a map: if everyone consults it, collisions become rare.

But the map has entries for places no one lives. Port 3649 is one of those entries — registered, labeled, and quiet. It is a placeholder for a protocol that either never launched publicly or was abandoned before it could be documented.

The port itself is perfectly usable. If your application needs a port and 3649 is free on your network, nothing stops you from using it. Just know that anyone who looks it up will find a name from 2003 and nothing else.