What Range This Port Belongs To
Port 3386 sits in the registered port range (1024-49151). These ports are theoretically assigned by IANA to specific services, but in practice the registry has gaps — ports that are reserved in concept but never formally claimed. Port 3386 is one of them. IANA lists it as unassigned.
That doesn't mean nothing uses it.
The Unofficial Tenant: GTP-Prime
In mobile carrier networks, port 3386 is the conventional home of GTP' (GTP-Prime), a variant of the GPRS Tunneling Protocol designed for one specific job: moving Charging Data Records (CDRs) from where they're generated to where they're stored.
Here's the chain: when your phone uses data, a network node called the GGSN (or SGSN in older networks) generates a CDR — a structured record of what you used, when, and how much. That record needs to travel to the Charging Gateway Function (CGF), which aggregates and validates it before it becomes part of your bill.
GTP-Prime is the protocol that carries those records. It operates over TCP or UDP on port 3386. The 3GPP standards body formalized this in TS 32.295, first published in Release 6 in 2004, though the convention predates that. 1
GTP-Prime is deliberately not a tunneling protocol — it shares GTP's message format but strips out the tunneling machinery. Its only job is reliable data record delivery. Getting your bill right matters more than speed.
Who Actually Sees This Port
Almost nobody outside a carrier network. Port 3386 traffic on a normal enterprise or home network is either:
- A misconfigured application
- Malware that picked an obscure port hoping not to be noticed
- Legitimate carrier equipment that somehow ended up on your network segment (very unusual)
If you see unexpected traffic on port 3386, it warrants investigation.
How to Check What's Listening
On Linux or macOS:
On Windows:
If something is listening and you don't know what it is, the process ID from these commands will tell you. On Linux, ls -la /proc/<pid>/exe points to the binary.
Why Unassigned Ports Matter
The registered port range has over 48,000 slots. IANA has formally assigned only a fraction. The rest are "unassigned" — which in practice means informal conventions fill the vacuum.
GTP-Prime and port 3386 are a good example: a real, standardized protocol using a port that technically doesn't belong to it. The 3GPP spec says "port 3386" but IANA never made it official. This is common. The port numbering system is part registry, part convention, part historical accident.
The lesson: "unassigned" doesn't mean "empty." It means no one filed the paperwork.
이 페이지가 도움이 되었나요?