Port 3326: SFTU — Registered, Never Deployed

What This Port Is

Port 3326 sits in the registered port range (1024–49151). These are ports that individuals and organizations can formally reserve with IANA, the Internet Assigned Numbers Authority, for their applications. Unlike the well-known ports below 1024 (which require root/administrator privileges to bind), registered ports can be used by any process.

IANA lists port 3326 as assigned to SFTU — Simple File Transfer Utility — registered by Eduardo Rosenberg de Moura at spacenet.com.br, a Brazilian Internet service provider. Both TCP and UDP are listed.¹

That's where the trail ends. SFTU left no RFC, no open-source code, no documentation, no forum posts. The assignment exists in the registry. The software, as far as the public Internet is concerned, does not.

What You Might Actually Find Here

If port 3326 is open on a machine you're examining, SFTU is almost certainly not the explanation. More likely candidates:

• Custom application traffic — developers pick obscure registered ports all the time to avoid collisions
• Database proxy or tunnel — occasionally used to forward traffic from services like MySQL (whose actual port is 3306, not 3326, despite some port databases claiming otherwise)
• Malware — some older trojans have been documented using this port for command-and-control traffic²

An open port 3326 with no known application is worth investigating.

How to Check What's Listening

On Linux/macOS:

ss -tlnp | grep 3326
# or
lsof -i :3326

On Windows:

netstat -ano | findstr :3326
tasklist | findstr <PID>

These commands show which process owns the port. An unfamiliar process name is a signal to dig further.

Why Unassigned (and Dormant) Ports Matter

The registered port range contains over 48,000 ports. Many, like 3326, are assigned but inactive — the software was never built, or never gained adoption. This creates a practical problem: the registry says the port belongs to SFTU, but no one is enforcing that. Any application can bind to it.

This is why firewall rules matter more than port assignments. The registry tells you what should be running on a port. Only your own system can tell you what is.