Port 3549: Tellumat MDR NMS — A Claimed, Forgotten Port

What Port 3549 Is

Port 3549 sits in the registered port range (1024–49151). These are ports that IANA tracks by assignment — real companies and projects applied for them, and IANA recorded the claim. That's different from the well-known ports (0–1023), which carry universal protocols like HTTP, SSH, and DNS. Registered ports are often niche: a specific vendor's product, an enterprise tool, a protocol that never achieved wide adoption.

Port 3549 is registered to Tellumat MDR NMS — the network management system for a product line from Tellumat, a South African telecommunications and defense company founded in 1963 as Plessey South Africa. IANA recorded the assignment in July 2002.¹

Tellumat built systems for air traffic management, defense communications, and tactical radio. MDR likely refers to one of their radar or communications product families. Their NMS would have allowed operators to monitor and manage those deployed systems remotely.

Tellumat has since sold its Air Traffic Management and Defense business units to HENSOLDT South Africa.² What happens to port assignments when a company restructures and a product line changes hands isn't something IANA tracks — the registry entry stays, but the software using it may no longer exist in any meaningful form.

What This Means in Practice

For the vast majority of networks, port 3549 is dead space. Nobody runs Tellumat MDR NMS in general-purpose infrastructure. The port is neither blocked by convention nor expected by any standard service.

If you see traffic on port 3549, it's almost certainly one of three things:

1. Automated scanning — Bots sweep the entire registered port range looking for open doors. The SANS Internet Storm Center logs regular scan activity on this port from various IP addresses.³
2. Coincidental application use — Some software picks ports without consulting the registry. An application, game server, or local tool might be using 3549 because its developer liked the number.
3. Actual Tellumat hardware — Unlikely unless you're managing air traffic control infrastructure in southern Africa.

How to Check What's Listening

If you see port 3549 active on your system, use these commands to identify what's using it:

Linux / macOS:

# Show which process owns port 3549
ss -tlnp sport = :3549

# Alternative with lsof
lsof -i :3549

Windows:

# Show process using port 3549
netstat -ano | findstr :3549

# Then look up the PID
tasklist | findstr <PID>

The output will give you a process name and ID. From there you can determine whether it's something you installed intentionally or something worth investigating.

Why Unassigned (and Obscure) Ports Matter

The registered port range contains thousands of entries like this one: officially claimed, practically unused, gradually orphaned as companies pivot or disappear. This matters for two reasons.

First, it creates ambiguity. Security tools that flag "known service on unexpected port" or "unknown service on known port" have to make judgment calls about ports like 3549. Is traffic here suspicious? Legitimate? There's no baseline to compare against.

Second, it represents the registry's limits. IANA can assign a port, but it can't enforce that assignment, retire it when the product dies, or update it when a company restructures. The registry is a snapshot frozen at the moment of registration. Reality drifts.

Port 3549 isn't dangerous. It isn't interesting. It's just a small artifact of the Internet's history — a South African defense company that needed a port number in 2002, got one, and moved on.