Port 3534: urld-port — The Port That Got a Name but Not a Life

What Port 3534 Is

Port 3534 is registered with IANA as urld-port — the URL Daemon Port — assigned on both TCP and UDP in June 2002 by Jim Binkley, a network security researcher at Portland State University.¹ Binkley is known for network anomaly detection work and tools like Ourmon, but no publicly documented implementation of the "URL Daemon" service exists.

The registration describes a service for URL resolution — presumably a daemon clients could query to canonicalize or retrieve metadata about URLs. Whether it was ever implemented, tested, or deployed outside of a research context is unknown. If it was, no trace remains.

The Registered Ports Range

Port 3534 sits in the registered ports range: 1024–49151.

This range is managed by IANA. Organizations and individuals can formally request a port assignment for a service they intend to deploy. Registration doesn't require that the service be widely used or even finished — only that someone asked for it. Port 3534 illustrates the result: the registry holds tens of thousands of ports, and many of them are names without implementations.

Below 1024 are the well-known ports — HTTP, SSH, DNS — services that actually run on the machines that keep the Internet alive. Above 49151 are the ephemeral ports, assigned dynamically to outgoing connections and immediately recycled. The registered range in between is where ambition and bureaucracy meet, and where many quiet reservations like this one sit.

What's Actually on Port 3534 Today

Nothing official. If you find something listening on port 3534 on your system, it isn't the URL Daemon — it's either an application that chose this port arbitrarily or something worth investigating.

SANS Internet Storm Center logs occasional scanning activity against port 3534, which is true of virtually every port in the registered range. Scanners probe everything.²

To see what's actually listening on this port on your system:

Linux / macOS:

# Show any process listening on port 3534
ss -tlnp | grep 3534

# Or with lsof
lsof -i :3534

Windows:

netstat -ano | findstr :3534

If you get no output, nothing is listening. That's the expected result for port 3534 on almost every machine in the world.

Why This Matters

The registered port range is a historical artifact of how the Internet was expected to grow. The assumption was that services would be centrally registered, clearly named, and permanently assigned. Reality disagreed. Most services today choose ports informally, and the registry has become a mix of critical infrastructure, long-abandoned reservations, and the occasional mystery like this one.

Port 3534 is a small monument to that gap — a slot reserved in 2002, never filled, still held.