Port 3141: Where π Lives on the Network

What Is Port 3141?

Port 3141 sits in the registered port range (1024–49151). These ports are assigned by IANA to specific services, though the assignment doesn't guarantee the service is widely used — or even still exists.

IANA officially lists port 3141 as assigned to VMODEM, a virtual modem service for both TCP and UDP. VMODEM has left almost no footprint on the modern Internet. You won't find running servers, active communities, or meaningful documentation. It's one of hundreds of registered-but-abandoned port assignments from networking's earlier eras.

The π Connection

In practice, port 3141 is recognized for one thing: it's the first four digits of π (pi: 3.14159...).

devpi — a private Python package index and caching proxy — defaults to port 3141. This wasn't an accident. "devpi" contains "pi," and 3141 is where pi begins. The developers made a math joke, and it stuck. When you run devpi-server and point pip at http://localhost:3141/, you're connecting to a port chosen because someone appreciated the elegance of the reference.

# devpi-server starts here by default
devpi-server --host 0.0.0.0 --port 3141

# pip uses it like this
pip install -i http://localhost:3141/root/pypi/+simple/ requests

devpi is genuinely useful: it caches packages from PyPI locally, lets teams host private packages, and survives PyPI outages. Organizations that depend on reproducible builds often run it. Port 3141 is where those private package indexes live.

Security History

Port 3141 has appeared in two security contexts worth knowing:

W32.Mydoom — The Mydoom worm (2004), one of the fastest-spreading email worms of its era, used port 3141 as part of its backdoor infrastructure. Seeing unexpected traffic on this port from an unfamiliar process is worth investigating.

Finjan SurfinGate — Older versions of this proxy product exposed an unauthenticated management interface on port 3141, allowing attackers to restart the service or modify policies without credentials.¹

Neither of these represents a current active threat, but they explain why security scanners sometimes flag this port.

What's Actually Listening?

If you see port 3141 open on a machine, you're most likely looking at:

• devpi-server — Python package proxy/index
• An old Finjan installation — unlikely in 2026, but possible in legacy environments
• Something custom — developers frequently use pi-referencing ports for internal tools precisely because they're memorable and unoccupied

To check what's using it:

# macOS / Linux
lsof -i :3141

# Linux alternative
ss -tlnp | grep 3141

# Windows
netstat -ano | findstr :3141

Why Unassigned Ports Matter

The registered range exists so that services can claim a port number and reduce the chance of collision. When VMODEM claimed 3141, it was trying to ensure no other official service would compete for the same port. That worked — but VMODEM itself faded away, leaving the port effectively unoccupied in practice.

This happens constantly across the registered range. Applications like devpi fill the gaps, using memorable or meaningful numbers that happen to be available. The result is a shadow layer of de facto port assignments that lives alongside the official IANA registry — real in practice, informal in status.

Port 3141 is a small example of how the Internet actually works: the official record says one thing, the math community agreed on something more elegant, and the digits of π got a home on the network.