Port 3393: D2K Tapestry — A Ghost in the Registry

What This Port Is

Port 3393 sits in the registered port range (1024–49151). These ports are assigned by IANA — the Internet Assigned Numbers Authority — to specific services and applications that requested a permanent home.

Port 3393's registered name is d2k-tapestry1: D2K Tapestry Client to Server.¹

Its neighbor, port 3394, is d2k-tapestry2: D2K Tapestry Server to Server. The two ports worked as a pair.

Who Was D2K Tapestry?

D2K Inc. was an enterprise software company operating in the late 1990s. Their flagship product, Tapestry, was an ETL tool — Extract, Transform, Load — designed to pull data out of mainframes, AS/400 systems, and Unix servers and feed it into ERP applications like SAP.²

The late 1990s were peak ERP mania. Companies were spending fortunes migrating legacy data into systems like SAP before Y2K. D2K formed an alliance with companies including MicroStrategy and Seagate Software to position Tapestry as the bridge between old iron and new enterprise software.³

Tapestry needed network ports to move data between clients and servers. It claimed 3393 and 3394. IANA recorded the registration.

Then the ERP wave crested, consolidation happened, and D2K Tapestry disappeared. The software is gone. The company is gone. The ports remain.

What the Registered Port Range Means

Registered ports are not exclusive reservations. Any application can technically bind to port 3393 on your machine. The IANA registry is a coordination mechanism, not enforcement.

What the registration does: it signals intent. If you see traffic on port 3393, you know someone once asked IANA to associate that number with D2K Tapestry. Whether D2K Tapestry is actually what's running is a different question entirely.

For a port like 3393 — where the registered software hasn't existed for over two decades — the registration is archaeological more than functional. It tells you what was there. It tells you nothing about what's there now.

What Might Actually Be There Now

If you see port 3393 active on a system today, it is almost certainly not D2K Tapestry. More likely candidates:

• Custom application: Internal software configured to use this port
• Developer tooling: Local services that picked a semi-arbitrary port
• Legacy enterprise software: Old ETL or middleware systems that historically used this range
• Nothing meaningful: Many ports scan positive simply because something claimed the port temporarily

Security databases flag port 3393 with generic "potential trojan" warnings, which is the default warning applied to any non-standard port with no active legitimate use. There is no specific known malware that targets or uses port 3393 as a signature port.⁴

How to Check What's Listening

On macOS or Linux:

lsof -i :3393

On Windows:

netstat -ano | findstr :3393

The output will show the process ID (PID) holding the port. From there:

macOS/Linux:

ps aux | grep <PID>

Windows (Task Manager): Match the PID in the Details tab.

If nothing responds, the port is closed — the expected state on any machine that never ran D2K Tapestry.

Why Ghost Ports Matter

IANA manages roughly 65,535 port numbers. The registered range alone spans 48,127 of them. Many registrations were made in the 1990s by companies and projects that no longer exist.

These ghost ports create a quiet problem: the registry says they're taken, which discourages other software from registering them. In practice, they're unclaimed wilderness. Software ends up using unregistered ports anyway, or the same port numbers get informally reused by applications that never bothered with IANA.

Port 3393 is a small example of this. A company registered a pair of ports, built software that used them, and then vanished. The ports are still technically D2K Tapestry's. They will be, forever, unless IANA reclaims them.

IANA does not reclaim expired registrations automatically. The dead hold their claims.