Port 345: Pawserv — The Ghost in the Registry

Port 345 sits in the IANA registry with an official assignment, but if you search for what actually uses it, you'll find almost nothing. This is a ghost port—officially claimed but rarely seen.

What Port 345 Is Assigned To

Port 345 (both TCP and UDP) is officially assigned to pawserv, which stands for "Perf Analysis Workbench" or "Performance Analysis Workbench."¹ Pawserv is supposedly the server for distributed PAW (Physics Analysis Workbench), listening for connections on port 345.

The problem? Almost no documentation exists about this software. Security professionals discussing this port in 2017 couldn't find any actual application associated with the name.² The software may have existed in some academic or research context decades ago, but it left barely a trace.

The White-Space Database Connection

Port 345 also appears in RFC 7545, published in May 2015, which defines the Protocol to Access White-Space (PAWS) Databases.³ This protocol allows devices to query geospatial databases for available radio spectrum—the "white space" between licensed frequencies that can be used without interference.

RFC 7545 doesn't assign port 345; it mentions it in passing. The protocol itself typically runs over HTTPS (port 443), not port 345. The connection between pawserv and white-space databases is unclear, possibly coincidental naming or a later attempt to repurpose an obscure port assignment.

What Range Port 345 Belongs To

Port 345 is in the well-known ports range (0-1023), also called system ports. These are assigned by IANA through formal procedures—IETF Review or IESG Approval—and traditionally required root/administrator privileges to bind to on Unix-like systems.⁴

Being in this range means port 345 was assigned early in Internet history, when port numbers were more freely given to projects that might not have achieved widespread use. Many well-known ports below 1024 are like this: officially assigned, rarely used, remnants of experiments or tools that never scaled.

Unofficial Uses and Malware

Port 345 has been used unofficially by various applications over the years. Some reports mention peer-to-peer (P2P) traffic on UDP port 345.¹ Educational cybersecurity courses have used port 345 in exercises for dissecting HTTP headers and sessions.

Security advisories note that Trojans and viruses have used port 345 for command-and-control communication in the past.¹ This doesn't mean the port itself is malicious—attackers use whatever ports are available and unmonitored. An obscure, rarely-used port like 345 is actually attractive for malware trying to avoid detection.

How to Check What's Listening on Port 345

On Linux or macOS:

sudo lsof -i :345
# or
sudo netstat -tuln | grep 345

On Windows:

netstat -ano | findstr :345

If nothing returns, port 345 isn't in use on your system—which is the most common case.

Why Unassigned (or Barely-Assigned) Ports Matter

The Internet has 65,535 possible ports for both TCP and UDP. Many ports below 1024 were assigned decades ago to projects that never gained traction or have since disappeared. Port 345 is one of these—technically assigned but functionally available.

These ghost ports matter because:

• They represent Internet history: Each assignment was someone's project, someone's hope that their protocol would matter. Most didn't. The registry is a graveyard of ideas.
• They create ambiguity: Is port 345 "used" because pawserv is assigned to it, even if no one runs pawserv? Can someone else use it? Should IANA reclaim it? These questions don't have clear answers.
• They're attractive to attackers: Ports that are assigned but unused are perfect for malware—they're less likely to be monitored, filtered, or flagged as suspicious.
• They show the limits of central coordination: IANA tried to organize the chaos by assigning ports, but you can't force adoption. Port 345 is assigned to pawserv whether pawserv exists or not.

The Honest Truth About Port 345

If you see traffic on port 345, it's probably not pawserv. It might be malware, a misconfigured application, a P2P client, or someone using an obscure port precisely because it's obscure.

Port 345 is a reminder that the Internet's infrastructure includes not just the protocols we use every day, but also the ones we don't—the assigned ports with no services, the RFCs nobody implements, the names in the registry that refer to nothing.

It exists. It's official. And it's almost certainly not doing what it was originally assigned to do.

Related Ports

• Port 80 (HTTP): Where unencrypted web traffic actually goes
• Port 443 (HTTPS): Where PAWS databases (RFC 7545) actually run
• Port 1024-49151 (Registered Ports): Where most modern applications register their services instead of claiming well-known ports