Port 3462: EDM STD Notify — A Registered Ghost

What This Port Is

Port 3462 sits in the registered port range (1024–49151), which means it carries an official IANA assignment. That assignment: EDM STD Notify, part of a three-port cluster used by an enterprise software distribution system.

The cluster:

The "EDM" system here refers to an enterprise software staging and distribution platform — not Electronic Dance Music, not Electronic Document Management in the modern sense, but a legacy software distribution tool that registered these ports with IANA and then quietly faded from visibility. No RFC documents it. No major vendor claims it. The registration outlasted the software.

What "Registered" Actually Means

IANA maintains the port registry to prevent collisions — to ensure two different applications don't unknowingly use the same port. When a vendor registers a port, IANA records the name and contact, not the protocol details. There's no requirement that the software still exist, be maintained, or even have documentation publicly available.

Port 3462 is a common outcome of this system: technically claimed, practically dormant. Thousands of registered ports are in the same state — assigned in the 1990s or 2000s to software that has since been discontinued, acquired, or abandoned. The registry doesn't expire entries.¹

A Note on the Neighbors

Port 3460, registered to "EDM Manager" by the same system, was later documented as the default listening port for PoisonIvy — a remote access trojan (RAT) that was widely used in targeted attacks in the 2000s and 2010s.² Port 3462 carries no such documented association, but the pattern is instructive: abandoned port registrations create opportunities. When software disappears, it leaves a port number with a thin cover story and no active defender.

How to Check What's Using This Port

If you see traffic on port 3462 and want to know what's responsible:

On macOS or Linux:

lsof -i :3462

On Windows:

netstat -ano | findstr :3462

Then match the PID to a process name in Task Manager, or:

tasklist | findstr <PID>

Legitimate traffic on this port today would be unusual. If something is actively using it, investigate.