Port 3579: ttat3lb — A Ghost in the Registry

What This Port Is

Port 3579 is registered with IANA under the name ttat3lb — Tarantella Load Balancing. It operates on both TCP and UDP.

Tarantella was a thin-client computing product built in the late 1990s to deliver Unix applications to any desktop over the web. Sun Microsystems acquired the company in 2004, renamed the product Secure Global Desktop (SGD), and later Oracle inherited it through the Sun acquisition. The product still exists in a limited form, but its days of active development are well behind it.¹

What the Port Does

When Tarantella/SGD used Advanced Load Management, port 3579 coordinated work between the primary SGD server and its array of application servers:

• TCP: The primary server contacts each application server on TCP port 3579 to request initial load information — essentially asking "how busy are you right now?"
• UDP: Application servers send regular load updates back to the primary server on UDP port 3579. The primary server listens for these heartbeats to determine which servers are alive and accepting work.

The dead-drop design is worth noting: if the UDP updates stop arriving, SGD interprets the silence as failure. Absence of signal is itself a signal.²

The Range: Registered Ports (1024-49151)

Port 3579 sits in the registered port range, sometimes called user ports. These ports:

• Are not reserved for exclusive system use (unlike well-known ports below 1024)
• Are registered with IANA to reduce conflicts between applications
• Can be used by any process without special privileges on most systems
• Are where the bulk of named application protocols live

A registered IANA entry doesn't mean a port is in active use everywhere. It means someone filed paperwork. Port 3579's registration dates to 2002, when Tarantella was still an independent company.

Known Unofficial Uses

A handful of other applications have been observed using port 3579 outside of Tarantella:

• Teamwork Cloud (TWCloud) — No Magic's enterprise modeling platform uses port 3579 for unencrypted (cleartext) client-server communication. Port 10002 is the default encrypted alternative.³
• Ombi — The media request management tool can be configured to listen on port 3579 via startup parameters, though it has no default claim on it.⁴

Neither use is widespread. If you find this port open on a system that runs neither SGD nor Teamwork Cloud, something else has claimed it.

How to Check What's Listening

Linux / macOS:

# Show the process using port 3579
sudo ss -tlnp sport = :3579

# Alternative with lsof
sudo lsof -i :3579

Windows:

netstat -ano | findstr :3579

Then match the PID to a process name using Task Manager or:

tasklist | findstr <PID>

Why Unassigned Ports Matter

Every port that isn't claimed is potential surface area. Attackers probe unassigned ports because applications sometimes listen there without appearing in obvious service inventories. Security scanners flag unexpected listeners on registered-but-dormant ports precisely because those ports should be quiet.

If you're running a firewall and have no Tarantella/SGD deployment, port 3579 should be silent. Noise on a port that should be quiet is worth investigating.