Port 3320: Office Link 2000 — A Ghost in the Registry

What This Port Is

Port 3320 sits in the registered port range (1024–49151), the middle tier of the port numbering system. Unlike the well-known ports below 1024 — where HTTP, SSH, and DNS live — registered ports are assigned by IANA to specific applications or services through a formal request process.

IANA's registry lists port 3320 as assigned to "Office Link 2000" (service name: officelink2000) on both TCP and UDP.¹ Both protocols are claimed.

The problem: no one can find what Office Link 2000 actually was.

The Ghost Registration

Sometime around the year 2000, a company or product called "Office Link 2000" registered this port with IANA. The registration succeeded. The software did not survive.

This is not unusual. The IANA registry is full of ports claimed by products from the dot-com era that have since vanished — acquired, abandoned, or simply forgotten. The registration process doesn't require renewal, so entries persist indefinitely after the software stops existing.

Port 3320 is registered, but registered by no one who's still home.

The Citrix Connection

Port 3320 also falls within a range used by Citrix Framehawk (UDP ports 3224–3324), a display protocol designed to deliver virtual desktops over lossy, high-latency connections.² Framehawk used UDP rather than TCP to reduce the performance cost of retransmission on poor networks.

As of Citrix Virtual Apps and Desktops 7 1903, Framehawk was deprecated in favor of Thinwire with adaptive transport.³ If you see UDP traffic on port 3320 in an older Citrix environment, that's likely the source.

What to Do If You See It

If something is listening on port 3320 on your machine, check what it is:

On Linux or macOS:

# Show what process is listening on port 3320
sudo ss -tlnp | grep 3320
# or
sudo lsof -i :3320

On Windows:

netstat -ano | findstr :3320

Then match the process ID to a running process using Task Manager or tasklist. A port is just a number — it doesn't tell you what's using it. The process does.

Why Unassigned (and Ghost) Ports Matter

The registered port range exists so that applications can claim a stable, predictable address — a place where other software knows to find them. A port without a living owner is just unclaimed territory: available for any application to use at startup, for testing, or for custom internal services.

Ghost registrations like this one create a subtle problem: the port shows as "registered" in databases, which may cause automated scanners or firewall rules to treat it as known infrastructure. It isn't. It's a placeholder from the early Internet era that never got cleaned up.