Port 3457: VAT Control — The command channel for the Internet's first audio conferences

Port 3457 is the control channel for VAT — the Visual Audio Tool — developed by Van Jacobson and Steven McCanne at Lawrence Berkeley National Laboratory in the early 1990s. ¹

Its partner is port 3456. That port carries the audio data. This port carries the commands that manage the session: who's talking, what's being muted, how the conference is being controlled.

What VAT Was

VAT was built for the MBone — the Multicast Backbone, an experimental overlay network that researchers used in the early 1990s to test whether the Internet could carry live audio and video. ²

It could, barely. Bandwidth was scarce. Multicast was fragile. The IETF held its first audio-broadcast meeting over the MBone in 1992. VAT was one of the tools that made it work.

The data/control port split — 3456 for audio, 3457 for control — was a deliberate design choice. Separating the streams allowed the control channel to stay responsive even when the data channel was congested. It was practical engineering for a network that frequently was.

Current Status

VAT is a relic. It predates widespread broadband, predates VoIP as a concept anyone had named, predates the audio stack that modern conferencing tools are built on. No production systems use it today.

IANA still lists the assignment. The ports remain reserved. The MBone mostly doesn't exist anymore.

Security Note

Some older security databases associate port 3457 with Backdoor.Amitis, a remote access trojan from 2003. ³ The connection is uncertain — some sources list port 3547 for that malware, and the two numbers are easy to transpose. Either way, Amitis is a 20-year-old threat against Windows XP-era systems. It is not a current concern.

Unexpected traffic on port 3457 today is more likely to be a misconfigured application or a port scanner than anything else.

Checking What's Listening on This Port

On Linux or macOS:

# Show what process is listening on port 3457
ss -tlnp | grep 3457

# Or with lsof
lsof -i :3457

On Windows:

netstat -ano | findstr :3457

On most systems, this will return nothing. Port 3457 sits quiet.

About the Registered Port Range

Port 3457 falls in the registered ports range (1024–49151). These ports are assigned by IANA to specific services, but unlike the well-known ports (0–1023), they don't require elevated privileges to use. Any application can bind to them. ⁴

The registration means IANA acknowledges VAT's historical claim on 3457. It doesn't mean anyone is actively using it.