Port 3282: Datusorb — The Ghost Name and the Citrix Range

What This Port Is

Port 3282 sits in the registered ports range (1024–49151). These ports are assigned by IANA to specific services upon request, unlike well-known ports (0–1023) which are reserved for foundational protocols and require more formal standardization.

IANA lists port 3282 as belonging to a service called "datusorb" — for both TCP and UDP. That's where the official record ends. There is no RFC, no public documentation, no company or project that publicly claims the datusorb name. It was registered, and then it disappeared into the administrative record.¹

This happens more than you'd expect. The registered ports range has thousands of entries, and a meaningful fraction of them point at software that never shipped, companies that folded, or internal tools that were registered optimistically and then quietly abandoned.

What Actually Uses This Port

Port 3282 falls within the UDP port range 3224–3324, which Citrix reserves for Framehawk — a display protocol designed to keep virtual desktops responsive over high-latency or lossy connections like congested Wi-Fi or mobile networks.²

Framehawk works over UDP rather than TCP, betting on speed over guaranteed delivery. When a virtual desktop session starts, it claims one port from this range. Because each concurrent session needs its own port, Citrix reserved 101 of them. Port 3282 is one of them — not specifically, just by being in the neighborhood.

If you're running Citrix Virtual Apps and Desktops (formerly XenApp/XenDesktop) and Framehawk is enabled, UDP traffic on port 3282 is normal. Firewalls between clients and VDA (Virtual Delivery Agent) servers need to allow the full 3224–3324 UDP range for Framehawk to function.³

Note: Citrix has been deprecating Framehawk in newer releases in favor of EDT (Enlightened Data Transport) on port 443. If you're on a modern Citrix deployment and seeing port 3282, it's worth confirming which protocol is actually in use.

How to Check What's Listening

If port 3282 is active on a machine you control, identifying it takes one command.

Linux / macOS:

ss -tulnp | grep 3282

or

lsof -i :3282

Windows:

netstat -aon | findstr :3282

Then match the PID to a process:

tasklist | findstr <PID>

The output will tell you which process owns the socket. On a Citrix server, expect to see the VDA or broker process. On a machine with no Citrix software, an unexpected listener here warrants investigation.

Why Unassigned Ports Matter

The registered ports range exists to bring order to the middle ground between system ports and ephemeral ports. Without it, two applications on the same network could independently choose the same port number and interfere with each other — or worse, one could masquerade as the other.

But the registry isn't perfectly maintained. Registrations accumulate. Assignments like "datusorb" persist long after whatever created them is gone. The range is large enough that most software just picks a port and uses it, with or without asking IANA — which is exactly what Citrix did with 3224–3324.

The result is a port system that is partly formal and partly practical: the registry says one thing, network traffic says another, and the truth is usually somewhere in between.