Port 3274: Ordinox Server — A Ghost in the Registry

What Range This Port Belongs To

Port 3274 sits in the registered ports range: 1024 through 49151. This range is maintained by IANA (the Internet Assigned Numbers Authority), and any organization can formally request that a port be reserved for their service. Unlike well-known ports (0-1023), which require administrative privileges to bind on most operating systems, registered ports carry no such restriction. Any process can open one.

The IANA registration is meant to prevent collisions — two different applications accidentally choosing the same port. In practice, the registry is also full of abandoned claims.¹

The Official Assignment: Ordinox Server

IANA lists port 3274 for both TCP and UDP under the name "ordinox-server" — Ordinox Server.²

What is Ordinox Server? That's where the trail goes cold. There is no findable documentation, no known product, no company that appears in any current source. The registration exists; the thing it names apparently does not. This is genuinely common in the registered ports space — ports claimed in the 1990s or early 2000s by companies that have since dissolved, products that were never shipped, or internal tools that were never made public. The registration stays. The service disappears.

If your system shows traffic on port 3274, it almost certainly isn't Ordinox Server.

What's Actually Using This Port

Port 3274 falls inside the default UDP port range that Citrix Framehawk uses for virtual desktop display traffic: 3224 through 3324.³

Framehawk was a display remoting technology built into Citrix XenApp and XenDesktop, designed for mobile workers on high-latency wireless connections. Where traditional screen-sharing protocols struggled over lossy networks — resending dropped packets, waiting, stuttering — Framehawk used UDP and simply accepted some pixel loss to keep things responsive. Think of it as the display protocol that shrugged at dropped packets instead of panicking.

Each concurrent Framehawk session claims a unique port within its configured range. Port 3274 would be taken by the 51st concurrent session (starting from 3224). On a multi-user XenApp server with enough simultaneous connections, 3274 gets used.⁴

Citrix has since deprecated Framehawk in newer versions of their platform, but installations running older XenApp/XenDesktop versions may still generate traffic here.

How to Check What's Listening on This Port

On Linux/macOS:

# Show what's listening on port 3274 (TCP)
ss -tlnp | grep 3274

# UDP
ss -ulnp | grep 3274

# Or with lsof
lsof -i :3274

On Windows:

netstat -ano | findstr :3274

The PID in the last column maps to a process. Use Task Manager or tasklist | findstr <PID> to identify it.

For network-wide visibility:

nmap -sU -p 3274 <target>   # UDP scan
nmap -p 3274 <target>        # TCP scan

Why Unassigned (and Ghost-Registered) Ports Matter

The registered ports range is a commons. There are 48,128 of them. They exist to make the ecosystem legible — to ensure that when your application listens on a port, something else isn't already expected there.

Ghost registrations like Ordinox Server illustrate the system's limits. IANA does not revoke abandoned registrations. Once claimed, a port stays claimed, even if the claimant vanishes. This means the registry is an imperfect map: it tells you what was intended, not necessarily what is.

For security purposes: an unexpected listener on any unrecognized port warrants investigation. Ghost registrations don't make a port dangerous, but they do make it easy to overlook.