Port 3399: CSMS — Registered but Forgotten

What Port 3399 Is

Port 3399 sits in the registered port range (1024–49151). These ports are formally tracked by IANA — the Internet Assigned Numbers Authority — so that software vendors and protocol designers can stake a claim to a port number without it being grabbed by someone else.

IANA records port 3399 as assigned to CSMS on both TCP and UDP. The adjacent ports follow the same pattern: port 3398 is "Mercantile," port 3400 is "CSMS2." What CSMS stands for, who registered it, and whether any software actively uses it today is not well-documented in public records. The registration exists. The story behind it doesn't seem to have made it into the public record.¹

The SAP Connection

The most plausible real-world use of port 3399 is as sapgw99 — the 100th slot in SAP's gateway port range.

SAP systems communicate through gateway processes that listen on ports 3300 through 3399, numbered by instance: sapgw00 through sapgw99. In a large SAP deployment with many application instances, the gateway ports fill up sequentially. Port 3399 is the last one — the 100th instance. Most organizations never get that far.²

If you see traffic on port 3399 in a network with SAP infrastructure, this is the most likely explanation.

How to Check What's Listening

To see if any process on your machine is using port 3399:

macOS / Linux:

# Show the process listening on port 3399
sudo lsof -i :3399

# Or with ss (Linux)
sudo ss -tlnp sport = :3399

Windows:

# Show connections and owning process IDs
netstat -ano | findstr :3399

# Then look up the PID
tasklist | findstr <PID>

If nothing is listening, port 3399 is closed on your machine. That's the expected state for most systems.

Why Unassigned-in-Practice Ports Matter

The registered range holds 48,128 ports. IANA has assigned names to most of them, but "assigned" doesn't mean "actively used." Many registrations are legacy entries from software that no longer exists, or placeholders from vendors who never shipped the product they planned.

These ports are not inherently dangerous — they're just unclaimed territory. But that's exactly why unexpected traffic on any unrecognized port deserves attention. If something is listening on 3399 on a machine that runs no SAP software and no known CSMS application, it's worth investigating.

Registered ports exist to prevent collisions. Unrecognized traffic on them is either forgotten software doing forgotten things, or something that doesn't belong.