Port 3686: tnmpv2 — A Registration That Went Quiet

What IANA Says

Port 3686 is registered, not unassigned. The IANA Service Name and Transport Protocol Port Number Registry lists it as:¹

• Service name: tnmpv2
• Description: Trivial Network Management
• Protocols: TCP and UDP
• Assignee: Andrea Premoli
• Registration date: January 2003

That's where the paper trail ends.

What "Trivial Network Management" Suggests

The name is a knowing nod to a pattern in networking: "Trivial" protocols are stripped-down alternatives to heavier standards. TFTP (Trivial File Transfer Protocol) is FTP without authentication. The naming convention implies tnmpv2 was intended as a lightweight alternative to SNMP (Simple Network Management Protocol) — simpler, smaller, easier to implement.

The "v2" in the name suggests a second version, which implies there may have been a v1 that preceded it. Neither is publicly documented.

Whatever was being built in 2003, it never reached public specification. No RFC was published. No open-source implementations appeared. No firewall vendor listed it in their threat databases. The protocol was registered and then, for all practical purposes, ceased to exist.

What Range This Port Belongs To

Port 3686 sits in the registered ports range: 1024 to 49151.

These ports are tracked by IANA. Anyone can apply to register a port for their service or protocol. IANA reviews the request and, if approved, records the name and contact in the registry. But registration doesn't require a public specification, ongoing maintenance, or active use. A port can be registered and then abandoned — and many are.

The registered range sits between:

• Well-known ports (0–1023): Reserved for foundational protocols like HTTP (80), SSH (22), and DNS (53). Require root or administrator privileges to bind on most systems.
• Dynamic/ephemeral ports (49152–65535): Assigned temporarily by the OS for outbound connections. Not registered.

What to Do If You See Port 3686

If something is listening on port 3686 on your system, it almost certainly isn't tnmpv2. It's most likely an application that chose this port for its own reasons — development tools, game servers, proprietary software, or something you installed that needed an open port and picked this one.

To check what's listening:

macOS/Linux:

# Show what process is using port 3686
sudo lsof -i :3686

# Alternative with netstat
sudo netstat -tlnp | grep 3686

# Or with ss (modern Linux)
ss -tlnp | grep 3686

Windows:

netstat -ano | findstr :3686
# Then check the PID:
tasklist | findstr <PID>

If something unfamiliar appears, check the process name against what you have installed. Port 3686 has no known association with common malware, but any unexpected listener is worth investigating.

Why Ghost Registrations Matter

The IANA registry isn't a museum of active protocols — it's also a graveyard of intentions. Thousands of ports were registered by developers, companies, and researchers who never shipped a public specification, whose companies folded, or whose protocols were superseded before anyone noticed.

These registrations still matter because they reserve the number. A port registered to an abandoned protocol won't accidentally be reassigned to something new. The ghost keeps its address, even if no one's home.

Port 3686 is one of these. Someone had a plan for lightweight network management in 2003. The plan went nowhere. The reservation stayed.