What This Port Is
Port 3396 is assigned by IANA to the printer-agent service — specifically, the Novell Distributed Print Services (NDPS) Printer Agent.1
NDPS was Novell's network printing system for NetWare environments. The Printer Agent ran on this port to receive print jobs, report printer status, and handle the communication between client workstations and network printers.
Novell NetWare was acquired by Attachmate in 2011 and has been effectively dead for years. If you see traffic on port 3396 today, it's almost certainly not NDPS.
The Registered Port Range
Port 3396 sits in the registered port range (1024–49151). This range is where IANA takes formal applications from vendors and organizations who need a stable, documented home for their protocol. Registered ports aren't reserved the way well-known ports (0–1023) are — any process can bind to them — but they carry an official record of intent.
The registration for port 3396 has an interesting footnote: IANA at some point renamed the service name from printer_agent to printer-agent, tidying up an underscore into a hyphen. A small act of maintenance for a protocol nobody runs.2
What You'll Actually Find Here
In practice, port 3396 is orphaned. It has a name, a registration, and almost no active users. If something is listening on this port on a modern system, it's either:
- Legacy NetWare infrastructure (rare, and getting rarer)
- An application that chose this port arbitrarily
- Something you should investigate
How to Check What's Listening
On Linux/macOS:
On Windows:
If you get a result, the process ID will tell you what's actually using it. Cross-reference with your process list.
Why Orphaned Ports Matter
The registered port space is a registry, not a lock. Ports 1024–49151 can be used by anyone for anything — the registration is just documentation. Orphaned ports like 3396 illustrate the gap between the map and the territory: IANA's registry reflects who claimed a port, not who's using it today.
For security purposes, any unexpected listener on any port is worth investigating. An unrecognized process on an obscure registered port is exactly the kind of thing that hides in plain sight.
Esta página foi útil?