Port 3421: bmap — A Ghost Registration

What Port 3421 Is

Port 3421 shows up in IANA's registry with a name: bmap, short for Bull Apprise portmapper. It was registered for use by Groupe Bull, a French computer company founded in 1931 that built mainframes, servers, and enterprise middleware throughout the twentieth century.

Their Apprise platform was enterprise application infrastructure — the kind of software that ran inside large European companies and government agencies. The portmapper's job was the same as any portmapper: tell clients which port a named service is actually listening on. ¹

Bull was acquired by Atos in 2014. ² The Apprise middleware did not survive the transition. Port 3421 is now a registered ghost — IANA still lists it, but no software running today claims it.

The Registered Ports Range

Port 3421 sits in the registered ports range: 1024 through 49151.

These ports are assigned by IANA on request. Anyone can apply. The process historically required little more than documentation and intent to use. The result is a registry littered with registrations for products that shipped once, were acquired, or quietly died — while the port number stays reserved in perpetuity.

The registered range is where most application-layer protocols live: databases, messaging systems, game servers, proprietary enterprise software. Some of those registrations are active and important. Others, like port 3421, are monuments to software that no longer runs.

What You'll Find Here Today

If you see traffic on port 3421, it is not Bull Apprise. That software has not shipped in over a decade. What you're more likely seeing:

• Application-assigned ports — software that picked an arbitrary port in the registered range and happened to land here
• Port scanning activity — automated scanners probe every port in the registered range routinely
• Malware or unauthorized software — some threat intelligence databases flag this port due to historical association with remote access tools, though no specific well-known malware family is definitively tied to it ³

How to Check What's Actually Listening

If port 3421 is open on a system you manage:

# On Linux/macOS — show what process owns the port
sudo ss -tlnp | grep 3421
sudo lsof -i :3421

# On Windows
netstat -ano | findstr :3421
# Then look up the PID in Task Manager

If nothing in your environment deliberately runs on 3421, there is no legitimate reason for it to be open. Close it.

Why Ghost Ports Matter

IANA's registry is permanent and first-come, first-served. When a company registers a port and their product dies, that number doesn't go back into the pool. It sits there, technically "registered," practically available for anything.

This is why port numbers alone cannot tell you whether traffic is legitimate. Port 3421 is "registered" — but to software nobody runs. Any service you find listening here today invented that use itself.