Port 3540: PNRP User Port — A Protocol's Registered Grave

What Port 3540 Is

Port 3540 sits in the registered port range (1024–49151) and carries an official IANA assignment: pnrp-port, for Microsoft's Peer Name Resolution Protocol. Registered in July 2002, it was the UDP port PNRP used to let Windows machines find each other without a central server.

The protocol is now gone from modern Windows. The registration is not.

What PNRP Was

PNRP was Microsoft's attempt at something genuinely interesting: a distributed, serverless naming system for peer-to-peer networks.

Normal DNS works because there are authoritative servers that know where things are. PNRP asked: what if there were no servers? What if every node that knew about a name could help others find it?

The answer was a distributed hash table layered over IPv6 — a system where peer names were stored and resolved cooperatively across the network of participating machines. No registrar. No zone files. No central authority. You published a name; other peers remembered it; anyone could ask any peer to help find it.

Microsoft shipped PNRP first in the Advanced Networking Pack for Windows XP in 2003. It required IPv6 to function. Windows Remote Assistance used it for the "Easy Connect" feature in Windows 7 — the one that let you share a short code to get remote help without configuring anything. That code was a PNRP peer name.

UDP port 3540 was what PNRP listened on. TCP port 3587 served the related Peer Grouping Infrastructure.¹

Why It's Gone

The PNRP cloud service was shut down in Windows 10 version 1809. The Win32 APIs were removed entirely in Windows 11 24H2.² The services — PNRPsvc, p2psvc, p2pimsvc, PNRPAutoReg — are no longer present in current Windows builds.³

Security guidance for years recommended disabling PNRP in enterprise environments. Its peer-to-peer model made it difficult to audit and control. The protocol never achieved broad third-party adoption outside of Microsoft's own features.

What You'll See on Port 3540 Today

On a modern Windows machine: nothing. On older Windows machines still running PNRP services: the Windows peer infrastructure.

On any non-Windows system: almost certainly nothing. PNRP was a Windows-only protocol.

To check what's listening on port 3540 on your system:

Linux/macOS:

ss -tulpn | grep 3540
# or
lsof -i :3540

Windows:

netstat -ano | findstr :3540

If nothing appears, nothing is listening. That's the expected result in 2026.

The Port Sits Reserved

Port 3540's IANA registration won't disappear — IANA doesn't reclaim registrations just because the protocol dies. The number is spoken for, even though no one's speaking on it.

This is what happens to ports after their protocols outlive their usefulness: the registration persists as a kind of record. If you're scanning networks and see traffic on 3540 today, it's either legacy Windows infrastructure or something you should look at more carefully.

Related Ports