Port 3149: NetMike Game Server — A Ghost in the Registry

What Port 3149 Is

Port 3149 belongs to the registered port range (1024–49151) — the middle tier of the port numbering system, below the well-known system ports and above the ephemeral ports your OS assigns on the fly.

The Internet Assigned Numbers Authority (IANA) lists this port as assigned to NetMike Game Server (service name: nm-game-server) on both TCP and UDP.¹ That's where the official story ends. NetMike Game Server has no surviving documentation, no community, no downloads, and almost no presence on the Internet. Whatever it was, it's gone.

The MyDoom Connection

Port 3149's actual notoriety comes from malware.

In early 2004, MyDoom.B — at the time the fastest-spreading email worm ever seen — opened TCP ports 3127 through 3198 as a backdoor on every machine it infected.² The intent was simple and ugly: let attackers connect to any infected host and run arbitrary code. Spam campaigns, DDoS attacks, further infections. Port 3149 was door number 23 of 72 in that hallway.

MyDoom eventually infected hundreds of thousands of machines and caused an estimated $38 billion in damage (inflation-adjusted). The ports it used became permanently associated with suspicious traffic, and 3149 carries that reputation in some security databases to this day.

What "Registered" Actually Means

The registered port range exists because not every application can claim a well-known port below 1024. Organizations register ports with IANA to prevent conflicts — to say "this is ours, don't use it for something else."

But registration isn't enforcement. IANA keeps a list; it doesn't police the network. A port can be registered to a defunct game server and simultaneously used by malware, a development tool, or your local Minecraft server. The registry is a coordination mechanism, not a guarantee.

Port 3149's situation — a forgotten registration, a malware history, an effectively empty present — is more common than you'd expect across the registered range.

What's Actually Listening on Your Port 3149

If you're seeing traffic on port 3149 and wondering what it is, check directly:

macOS / Linux:

sudo lsof -i :3149

Windows:

netstat -aon | findstr :3149

Then cross-reference the PID:

tasklist | findstr <PID>

If something unexpected is listening here on an older Windows machine, it's worth running a malware scan. The MyDoom infections are ancient history, but their techniques — opening ports, waiting for instructions — remain a template.