Port 3146: bears-02 — A Name Without a Service

What Port 3146 Is

Port 3146 sits in the registered ports range (1024–49151). These ports are tracked by IANA — the organization that coordinates Internet addressing — and assigned to specific services on request. The idea is that if your application needs a port, you register it, so other applications don't collide.

Port 3146 is registered. Its assigned service name is bears-02, attributed to a company called Bear Solutions and a person named Bruce McKinnon.¹

That's where the documentation ends.

There is no RFC for bears-02. No public specification. No open-source implementation. No forum posts from developers asking questions about it. The registration exists in the IANA database, but the service it names exists nowhere else that can be found.

This isn't unusual. The IANA registry contains hundreds of entries like this — names claimed during a period when registration was informal, tied to projects that were never finished, companies that dissolved, or products that shipped under a different name on a different port. The registry is a historical record as much as it is a technical reference.

What This Port Is Actually Known For

In early 2004, the MyDoom.B worm spread across Windows machines by email. Once installed, it opened a backdoor on port 3146 — allowing remote attackers to connect to infected machines and issue commands.²

MyDoom was one of the fastest-spreading email worms ever recorded. The .B variant added a denial-of-service component targeting both SCO Group and Microsoft. Port 3146 didn't cause any of that. It was just the door the worm left open after walking in.

The worm is long dead as an active threat, but it's why security scanners and IDS signatures still flag unexpected activity on port 3146. If you see unexplained traffic here on a Windows machine, it's worth investigating — though in practice, you're more likely to be seeing a port scanner than a two-decade-old worm.

How to Check What's Using This Port

On Linux/macOS:

ss -tlnp | grep 3146
# or
lsof -i :3146

On Windows:

netstat -ano | findstr :3146
# Then check the PID:
tasklist | findstr <PID>

If something is listening on port 3146 and you don't recognize it, that's worth a closer look.

Why Ghost Registrations Exist

The registered ports range was designed to prevent conflicts between applications. In theory: you pick a port, register it with IANA, and other applications avoid it. In practice, most applications never bother registering, and many registered ports were claimed speculatively — "we might build something here" — and then weren't.

IANA doesn't revoke registrations for inactivity. So the registry accumulates names without services: bears-02 on 3146, things-01 on 3190, and dozens more. They occupy space on a list without occupying space on any actual network.

Port 3146 is currently unoccupied on most systems. Nothing commonly ships using it. If you're looking for a port for your own application, check IANA first — but also check whether real-world usage conflicts exist, because the registry and reality don't always agree.