Port 3: CompressNET — The Ghost of Compression Past

Port 3 is reserved. If you connect to it, nothing answers. For over thirty years it was assigned to something called CompressNET, a compression protocol that left almost no trace. In February 2025, IANA formally de-assigned it.¹ Port 3 is now one of the lowest-numbered doors on the Internet with no one home.

What Was CompressNET?

CompressNET was a protocol for compressing data in transit. Port 2 handled the "Management Utility" and port 3 handled the "Compression Process."² The idea was straightforward: compress packets before sending them, decompress on arrival, save bandwidth.

The protocol was registered by Bernie Volz at Process Software Corporation, a company based in Massachusetts that built networking tools for VAX/VMS systems.³ His contact was listed as VOLZ@PROCESS.COM.

That's nearly everything that survives about CompressNET. No RFC describes its wire format. No open-source implementation exists. No documentation explains how the compression worked or what algorithm it used. It was registered, listed in the Assigned Numbers documents starting with RFC 1340 in 1992,² and then it sat there, untouched, for decades.

The Man Behind It

Bernie Volz registered ports 2 and 3 in the early days of port assignment, when the well-known port range only extended to 255.² He was at Process Software then. He later moved to Cisco, where he co-authored RFC 3315, the specification for DHCPv6,⁴ the protocol that assigns IPv6 addresses to devices. He also co-authored RFC 8415, the updated DHCPv6 specification,⁵ and RFC 2525 on known TCP implementation problems.

The compression protocol vanished. The man who registered it went on to help build one of the foundational services of the modern Internet. Port 3 just waited.

The De-Assignment

On February 13, 2025, IANA de-assigned ports 2 and 3, moving them from "Assigned" to "Reserved" status.¹ This means they are not available for new service assignments. They exist in a kind of administrative limbo: no longer belonging to CompressNET, but not open for anyone else either.

This is rare. Most early port assignments persist indefinitely in the IANA registry, even when the protocols behind them are long dead. The de-assignment of ports 2 and 3 is a quiet acknowledgment that these assignments served no purpose.

What "Reserved" Means

Port 3 sits in the System Ports range (0 through 1023), the most controlled block of port numbers. Assignment in this range requires IETF Review or IESG Approval, as defined in RFC 6335.⁶ These ports are guarded because they carry implicit trust on many operating systems. On Unix-like systems, binding to a port below 1024 typically requires root privileges.

"Reserved" is distinct from "Unassigned." An unassigned port is available for future assignment. A reserved port is held by IANA and not available for regular assignment.⁶ Port 3 is in this second category. It has been deliberately set aside.

Security

Port 3 has no legitimate service listening on modern systems. If you find something listening on port 3, investigate immediately. Some security databases have flagged port 3 as historically associated with trojan activity, though this is not specific to the port itself. Malware can bind to any port, and low-numbered ports with no expected service make convenient hiding spots precisely because no one monitors them.

How to Check What's Listening on Port 3

Linux:

sudo ss -tlnp | grep ':3 '
sudo lsof -i :3

macOS:

sudo lsof -i :3

Windows:

netstat -ano | findstr ":3 "

If any process is bound to port 3 and you did not put it there, treat it as suspicious.

Why Unassigned Ports Matter

The port number system has 65,535 entries. Only a fraction carry assigned services. The unassigned and reserved ports are not wasted space. They are the negative space that gives the system structure. Without empty ports, there would be no room for new protocols, no space for ephemeral connections, no way to distinguish a known service from an unknown one.

Port 3 matters not because something runs on it, but because it is one of the oldest examples of something that stopped running. It is a reminder that the Internet's infrastructure is not permanent. Protocols come and go. Assignments are made and, thirty years later, quietly revoked. The registry is a living document, not a monument.