Port 3422: Remote USB System Port — Digi's Unclaimed Claim

What Port 3422 Is

IANA has not assigned port 3422 to any official service. It sits in the registered port range — the band of ports from 1024 to 49151 where anyone can petition IANA for an official assignment, but where most ports remain unclaimed.

In practice, port 3422 has an identity anyway. Some port databases list it under the name rusb-sys-port (Remote USB System Port), a label that appears to trace back to Digi International, the networking hardware company behind the AnywhereUSB product line.¹

The Digi Connection

AnywhereUSB devices are network hubs that let remote computers access physically attached USB devices as if they were local. The underlying protocol is called RealPort. Digi uses a small cluster of ports for RealPort communication, and port 3422 is specifically designated for USB session connectivity from the device to the host computer.²

What makes this notable: Digi's own documentation states this port "cannot be changed." Unlike many services that let you configure which port they listen on, this one is hardcoded.

That means any network with AnywhereUSB hardware will have port 3422 open and listening, whether the administrator thinks about it or not.

The Unassigned Port Reality

The registered port range contains 48,127 ports. A fraction of them have formal IANA assignments. The rest exist in a grey zone where:

• Vendors pick them informally and rely on nobody else claiming the same number
• Software uses them as defaults, quietly establishing de facto reservations
• Malware occasionally inhabits them precisely because they're unmonitored

Port 3422 has seen all three. Security researchers have observed IRC bot traffic on this port — not because of any vulnerability in Digi's software, but because attackers probe unmonitored ports looking for footholds.³

How to Check What's Using It

If you see activity on port 3422 and don't have AnywhereUSB hardware, it's worth investigating.

On Linux/macOS:

# See what's listening on port 3422
ss -tlnp | grep 3422

# Or with lsof
lsof -i :3422

On Windows:

netstat -ano | findstr :3422

The process ID in the output can be matched against Task Manager or tasklist to identify what's running.

If nothing is listening but you're seeing inbound connection attempts, that's normal background noise — automated scanners probe every port on the Internet constantly, and an unassigned port that's been associated with hardware is a natural target.