Port 3403: Formerly CopySnap — A Retired Registered Port

Port 3403 is a registered port with a small history. It was once officially assigned to a service called "CopySnap Server Port," then de-registered by IANA in 2006. ¹ No service owns it now. If you see traffic on this port, something chose it on its own.

The Registered Port Range

Port 3403 falls in the registered port range: 1024 to 49151. ²

Well-known ports (0-1023) are reserved for foundational Internet services — HTTP, HTTPS, SSH, DNS. They require elevated privileges to open on most operating systems. Registered ports don't carry that weight. Any application can open them, and many do — by registering their intended use with IANA so other software knows to stay clear.

That registration system only works when registrations hold. When they're abandoned, the port becomes a gap — not an empty field, but a formerly claimed address with no current occupant.

What Was CopySnap?

The historical record is thin. IANA's registry shows port 3403 was assigned to "CopySnap Server Port," modified and de-registered on 2006-10-27. ¹ What CopySnap did, who built it, and why it was abandoned aren't documented in any surviving reference. The service didn't leave enough of a footprint to trace.

This is more common than it sounds. Software gets discontinued. Companies fold. Port registrations sit in the IANA database long after the applications that registered them stop running, and sometimes registrations get explicitly withdrawn when a product disappears.

Current Status

No major applications are known to use port 3403 today. No malware families have claimed it prominently. It's simply unoccupied — available for any application that opens it, watched by nothing in particular.

If you're seeing activity on port 3403, it likely falls into one of these categories:

• A custom or proprietary internal application that chose this port arbitrarily
• A developer's local service during testing
• Port scanning or network enumeration touching this range

How to Check What's Listening

On Linux or macOS:

ss -tlnp | grep :3403
# or
lsof -i :3403

On Windows:

netstat -ano | findstr :3403
# Then look up the PID:
tasklist | findstr <PID>

If something is listening, the process name and PID will tell you what claimed the port.

Why Retired Ports Matter

An IANA registration doesn't mean traffic on that port is legitimate — it just means someone once told IANA they intended to use it. When that registration expires or gets withdrawn, the port doesn't announce itself as available. Other software doesn't know it's free. Anyone writing a new application that wants an obscure registered port might pick 3403 without knowing it had a prior occupant.

The port system relies on coordination. When coordination breaks down — when registrations go stale, when software disappears without releasing its number — the registry drifts slightly away from reality. Port 3403 is one small example of that drift.