Port 346 sits in the well-known ports range with an official IANA assignment to "zserv"—the Zebra routing daemon. But here's the thing: the software it was assigned for has been dead since 2005. This port is a ghost, a permanent reservation for something that no longer exists.
What Port 346 Was For
Port 346 (both TCP and UDP) was assigned to the Zebra routing daemon—specifically the core "zserv" process that managed the routing table.12 Zebra was routing software that turned a Unix box into a full-powered router supporting RIP, OSPF, and BGP.3
The idea came from Kunihiro Ishiguro in 1996 when he realized there was no quality open source routing software.4 At the time, if you wanted a router, you bought a Cisco. If you wanted routing protocols on Unix, you were mostly out of luck.
Zebra changed that. It was distributed under the GNU General Public License and provided the kind of routing engine that could compete with commercial solutions.5 The architecture was clever: a core daemon (zebra/zserv) that abstracted the kernel's routing table, with separate daemons for each routing protocol that communicated with zebra over TCP sockets or Unix domain sockets.6
Port 346 was zebra's door—where the routing protocol daemons connected to update the routing table.
What Happened to Zebra
Development stopped in 2005. The official website announced "Zebra has been decommissioned."7 The last release was version 0.95 in September 2005.
But the idea didn't die. A fork called Quagga became the unofficial successor, continuing development.8 Then in 2017, FRRouting forked from Quagga, aiming for faster, more open development.9 Both successors kept the zebra daemon at their core—they just renamed things and moved to different port numbers.
FRRouting's zebra daemon, for instance, typically listens on TCP port 2600, not 346.10 The architecture remains, the name remains, but port 346 was left behind.
The Current State: Officially Assigned, Practically Empty
Port 346 is still listed in the IANA registry as assigned to zserv.11 It's a well-known port (range 0-1023), meaning it was reserved through official IETF procedures for what was supposed to be a permanent, important service.
But walk through a modern data center and you won't find anything listening on 346. The successors to Zebra—the software actually running production networks—use different ports. Port 346 is a permanent reservation for software that died two decades ago.
There's one more detail: port 346 (particularly UDP 346) has been flagged in security databases as having been used by trojans in the past.12 When a port sits unused by its intended service, malware sometimes moves in. The port isn't inherently malicious—it's just empty, and empty spaces attract squatters.
Why Unassigned-But-Assigned Ports Matter
Port 346 represents something strange in the port number system: a port that is officially assigned but functionally unassigned. The IANA says it belongs to zserv. Reality says nobody's home.
This happens more than you'd think. The well-known ports range is full of assignments to software that's obsolete, protocols that were never widely adopted, or services that moved to different ports over time. The registry is a historical record as much as it is an operational directory.
Port 346 matters because it shows how the Internet accumulates history. When Kunihiro Ishiguro needed a port number for his routing daemon in the late 1990s, he got 346. Twenty-five years later, that assignment remains even though the software it was assigned for is gone.
The port number is a memorial. It says: something important happened here once.
How to Check What's Listening on Port 346
If you want to see if anything is actually using port 346 on your system:
On Linux or macOS:
On Windows:
If you find something listening there, it's either:
- A very old Zebra installation (unlikely)
- A modern router daemon configured to use the legacy port (unusual)
- Something else entirely—potentially malware
Given the port's history and the fact that modern routing software has moved on, anything you find on 346 deserves investigation.
Related Ports
- Port 2600 — Where FRRouting's zebra daemon actually listens
- Port 2601-2609 — Other FRRouting protocol daemons (BGP, OSPF, RIP, etc.)
- Port 179 — BGP (Border Gateway Protocol), one of the protocols Zebra implemented
Was this page helpful?