Port 3695: BMC Data Collection — A Quiet Enterprise Reservation

What Port 3695 Is

Port 3695 sits in the registered ports range (1024–49151), the middle tier of the port numbering system. These ports aren't reserved for foundational Internet infrastructure like the well-known ports below 1024, but they're not random either. They're claimed — by vendors, organizations, and projects that asked IANA to reserve a number for their software.

Port 3695 was claimed by BMC Software in February 2003, registered under the service name "BMC Data Collection" for both TCP and UDP.¹

What BMC Data Collection Is

BMC Software builds enterprise IT operations tools — workload automation, infrastructure monitoring, service management. Their platform includes products like Control-M (job scheduling) and PATROL (infrastructure monitoring), which need to move performance metrics, health data, and job status information between components running on different servers.

"Data collection" in this context means exactly what it sounds like: an agent on one machine sending operational data to a central collection point. Port 3695 appears to be part of that internal communication plumbing.

This is not a protocol you'll find an RFC for. BMC's internal service communication is proprietary. If you see port 3695 active on a machine, it's almost certainly running a BMC Software product.

The Registered Ports Range

The registered ports range (1024–49151) holds over 48,000 ports. Most of them look like port 3695: a vendor registered a number, shipped software that uses it, and that's the end of the story. The port isn't famous. It doesn't carry Internet traffic. It just does its job inside enterprise data centers.

The alternative — software vendors choosing random port numbers without registration — would be chaos. Two products would collide constantly. IANA registration is how vendors stake a claim and avoid conflicts.

Not all registered ports are actively used. Some registrations are abandoned. Some products are discontinued. Some ports were registered speculatively and never deployed. The registry is a record of intent, not necessarily current activity.

What to Do If You See This Port

If port 3695 shows up in a scan or a firewall log, the likely explanation is a BMC Software product running on that machine. Check what software is installed and what's listening:

On Linux/macOS:

# Show what process is listening on port 3695
sudo ss -tlnp | grep 3695
# or
sudo lsof -i :3695

On Windows:

# Show process listening on port 3695
netstat -ano | findstr :3695
# Then look up the PID:
tasklist | findstr <PID>

If nothing shows up and you're seeing traffic to this port from outside your network, treat it as suspicious — scanners probe registered ports looking for misconfigured or vulnerable services.