Port 3168: PowerOnNUD — A Ghost Registration and Citrix VPN

What Port 3168 Is

Port 3168 sits in the registered port range (1024–49151). These are ports that applications and vendors can formally register with IANA, the organization that coordinates the Internet's naming and numbering systems. Registration doesn't grant exclusive use — it's more like planting a flag and saying "we're here."¹

IANA's registry lists port 3168 as assigned to poweronnud, the public server component of Now Up-to-Date, a personal information manager and calendar application developed by Now Software in the 1990s.² Now Software was acquired, absorbed, and effectively disappeared. The port registration outlived the company by decades. The record exists; the software largely doesn't.

What Actually Uses It

Despite the ghost registration, port 3168 shows up in the real world in one context: Citrix NetScaler Gateway (now Citrix Gateway) uses it over UDP for VPN tunnel connections — specifically for the Citrix Gateway Plug-in when establishing secure ICA connections for remote desktop and application delivery.³

This is unofficial, unregistered use. Citrix never claimed the port through IANA. They picked it because it was available and quiet. The fact that it was already "registered" to a dormant product didn't stop them — and in practice, nothing enforces those older registrations anyway.

The Range It Lives In

The registered range (1024–49151) is where most application-layer services live. Unlike the well-known ports (0–1023), which require root or administrator privileges to bind on Unix-like systems, anyone can open a server on port 3168. The range is large enough that collisions are rare, which is why unofficial uses like Citrix's can coexist alongside forgotten registrations without causing problems in the wild.

How to Check What's Listening

If you see traffic on port 3168 and want to know what's using it:

On Linux/macOS:

# Show what process is listening on port 3168
sudo ss -tlnp | grep 3168

# Or with lsof
sudo lsof -i :3168

On Windows:

# Show listening ports with process IDs
netstat -ano | findstr :3168

# Then look up the PID
tasklist | findstr <PID>

If you're on a corporate network and see UDP traffic on 3168, Citrix VPN infrastructure is the likely explanation. If you're not on a Citrix network, something else has claimed the port — check the process.

Why Unassigned and Dormant Ports Matter

Port 3168 is a small illustration of a real problem: the registered port namespace has thousands of entries pointing at products that no longer exist, companies that were acquired, and protocols that never gained adoption. These registrations don't expire. They just sit there, technically claimed, practically available.

Software vendors fill this gap by using ports opportunistically, picking numbers that appear quiet and hoping the real-world collision rate stays low. For port 3168, it has. But the gap between what IANA records and what networks actually carry is wide, and tools like ss, lsof, and netstat are how you find the truth on any given machine.