Port 3585: Emprise License Server — Registered but Rarely Seen

What Port 3585 Is

Port 3585 sits in the registered ports range (1024–49151). IANA lists it under the service name emprise-lls, assigned to the Emprise License Server on both TCP and UDP.¹

The registered owner is Emprise Technologies, a consulting firm specializing in the accounts receivable and financial services industries.² Their license server is a proprietary component, not a public protocol. No RFC exists for it. No open specification. If you encounter port 3585 in the wild, it is almost certainly either their specific software or something unrelated using the port opportunistically.

What the Registered Range Means

Ports from 1024 to 49151 are called registered ports. Unlike the well-known ports below 1024 (which are reserved for foundational Internet protocols and require root privileges to bind on Unix systems), registered ports are simply claimed through IANA by organizations who want a consistent, documented home for their software.

Registration is not enforcement. Any application can open port 3585 on your machine. The IANA assignment just means Emprise asked first and got it on record.

If You See Port 3585 Open

Unless you are running Emprise Technologies software, an open port 3585 is worth investigating. It could be:

• A legitimate application that chose this port arbitrarily
• Malware using an obscure registered port to blend in
• A misconfigured service

How to Check What Is Listening

On Linux or macOS:

# Show the process using port 3585
sudo lsof -i :3585

# Or with ss (Linux)
sudo ss -tlnp | grep 3585

On Windows:

# Show process and port mapping
netstat -ano | findstr :3585

# Then look up the PID
tasklist | findstr <PID>

The process name returned will tell you exactly what is using the port.